fix(missions): enforce access control on dashboard and intel mission queries

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/app/(frontend)/intelligence/campaigns/[id]/page.tsx

@@ -2,6 +2,7 @@ import config from "@payload-config";
 import { getPayload } from "payload";
 import { notFound } from "next/navigation";
 import Link from "next/link";
+import { headers as nextHeaders } from "next/headers";
 import type { Faction, Media, Mission } from "@/payload-types";
 import { RichText } from "@payloadcms/richtext-lexical/react";
 import { ClientDate } from "@/components/frontend/ClientDate";
@@ -37,6 +38,10 @@ const factionTypeColors: Record<string, string> = {
 export default async function CampaignDetailPage({ params }: CampaignDetailPageProps) {
   const { id } = await params;
   const payload = await getPayload({ config });
+  const { user } = await payload.auth({
+    headers: await nextHeaders(),
+    canSetHeaders: false,
+  });
 
   const campaign = await payload
     .findByID({
@@ -81,6 +86,8 @@ export default async function CampaignDetailPage({ params }: CampaignDetailPageP
         sort: "-classification.startDateTime",
         limit: 100,
         depth: 1,
+        user,
+        overrideAccess: false,
         select: {
           name: true,
           codeName: true,

src/app/(frontend)/intelligence/campaigns/page.tsx

@@ -1,5 +1,6 @@
 import config from "@payload-config";
 import { getPayload } from "payload";
+import { headers as nextHeaders } from "next/headers";
 import { ShieldIcon } from "lucide-react";
 import { CampaignCard } from "@/components/frontend/intelligence/CampaignCard";
 import { CreateCampaignDialog } from "@/components/frontend/intelligence/CreateCampaignDialog";
@@ -12,6 +13,10 @@ export const metadata = {
 
 export default async function CampaignsPage() {
   const payload = await getPayload({ config });
+  const { user } = await payload.auth({
+    headers: await nextHeaders(),
+    canSetHeaders: false,
+  });
 
   const campaignsRes = await payload.find({
     collection: "campaigns",
@@ -49,6 +54,8 @@ export default async function CampaignsPage() {
         where: { "classification.campaign": { equals: campaign.id } },
         depth: 0,
         limit: 100,
+        user,
+        overrideAccess: false,
         select: {
           missionRoles: true,
           classification: true,

src/app/(frontend)/intelligence/factions/[id]/page.tsx

@@ -2,6 +2,7 @@ import config from "@payload-config";
 import { getPayload } from "payload";
 import { notFound } from "next/navigation";
 import Link from "next/link";
+import { headers as nextHeaders } from "next/headers";
 import type { BankAccount, Campaign, Faction, Media, Mission, Resource } from "@/payload-types";
 import { RichText } from "@payloadcms/richtext-lexical/react";
 import { convertLexicalToPlaintext } from "@payloadcms/richtext-lexical/plaintext";
@@ -72,6 +73,10 @@ function relationshipTone(value: number): { bar: string; text: string; label: st
 export default async function FactionDetailPage({ params }: FactionDetailPageProps) {
   const { id } = await params;
   const payload = await getPayload({ config });
+  const { user } = await payload.auth({
+    headers: await nextHeaders(),
+    canSetHeaders: false,
+  });
 
   const faction = await payload
     .findByID({
@@ -126,6 +131,8 @@ export default async function FactionDetailPage({ params }: FactionDetailPagePro
       sort: "-classification.startDateTime",
       limit: 100,
       depth: 1,
+      user,
+      overrideAccess: false,
       select: {
         name: true,
         codeName: true,

src/app/(frontend)/page.tsx

@@ -74,6 +74,8 @@ export default async function HomePage() {
       sort: "classification.startDateTime",
       limit: 5,
       depth: 2,
+      user,
+      overrideAccess: false,
     })
     .catch(() => ({ docs: [] }));
 
@@ -89,6 +91,8 @@ export default async function HomePage() {
         sort: "-classification.startDateTime",
         limit: 1,
         depth: 2,
+        user,
+        overrideAccess: false,
       })
       .catch(() => ({ docs: [] }));
     briefingMission = completedRes.docs[0] ?? null;
@@ -185,6 +189,8 @@ export default async function HomePage() {
         .find({
           collection: "missions",
           limit: 0,
+          user,
+          overrideAccess: false,
         })
         .catch(() => ({ totalDocs: 0 })),
       payload.find({