fix: loan error surfacing, non-admin export, guarded atomic migration, expanded player controls

web/test/settings.test.tsx

@@ -201,4 +201,11 @@ describe('SettingsPage', () => {
     await userEvent.click(await screen.findByRole('button', { name: /back up now/i }))
     await waitFor(() => expect(screen.getByText(/backup failed/i)).toBeTruthy())
   })
+
+  it('non-admin sees the Export link but not backups', async () => {
+    stubAuthFetch({ id: 2, username: 'bob', isAdmin: false })
+    renderSettings()
+    expect(await screen.findByRole('link', { name: /export json/i })).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /back up now/i })).toBeNull()
+  })
 })