v3: fixed roles propagation bug, fixed inconsistent file drop zone, fixed chat attachments wrongfully pruned, some visual tweaks

src/contexts/AuthProvider.tsx

@@ -2,7 +2,11 @@ import { type ReactNode, useEffect, useState } from "react";
 
 import { AuthContext, type AuthContextValue } from "./AuthContext.ts";
 
-import { type AuthResponse, deserializeAuthResponse } from "../model.ts";
+import {
+  type AuthResponse,
+  deserializeAuthResponse,
+  deserializePublicUser,
+} from "../model.ts";
 import { API_URL } from "../config/api.ts";
 
 function isTokenExpired(token: string): boolean {
@@ -60,6 +64,23 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         if (res.status === 401) {
           localStorage.removeItem("authResponse");
           setAuthResponse(null);
+          return;
+        }
+        // The stored user is a snapshot from login time; the role (and other
+        // profile fields) can change server-side — e.g. an admin promoting this
+        // user. Sync from the authoritative /me response so the UI reflects role
+        // changes without forcing a logout/login cycle.
+        if (res.ok) {
+          const json = await res.json();
+          if (json?.success && json.data) {
+            const freshUser = deserializePublicUser(json.data);
+            setAuthResponse((prev) => {
+              if (!prev || prev.user.role === freshUser.role) return prev;
+              const updated = { ...prev, user: freshUser };
+              localStorage.setItem("authResponse", JSON.stringify(updated));
+              return updated;
+            });
+          }
         }
       } catch {
         // Network error — don't log out an offline user; only an explicit 401 clears the session.