Index: src/routes/admin-sites.js
===================================================================
--- src/routes/admin-sites.js	(revision 8b014efbf867f5c2687f4c1aed544e6e7ef34386)
+++ src/routes/admin-sites.js	(revision ab544fd29596ce8734fe93bc1d317872adc0b665)
@@ -22,5 +22,5 @@
 import db from '../config/database.js';
 import { renderPage } from '../middleware/render.js';
-import { requireGod } from '../middleware/auth.js';
+import { requireGod, requireAuth, requireSiteManagerBySlug } from '../middleware/auth.js';
 import ThemeService from '../services/ThemeService.js';
 import { listPlatforms, PLATFORMS } from '../services/PlatformIcons.js';
@@ -82,5 +82,5 @@
 // holds the URL string in `profile_photo` — this endpoint just stores the
 // file and hands back a URL that the form can paste into the input field.
-router.post('/upload-photo', requireGod, (req, res) => {
+router.post('/upload-photo', requireAuth, (req, res) => {
   photoUpload.single('photo')(req, res, (err) => {
     if (err) return res.status(400).json({ ok: false, error: err.message });
@@ -218,5 +218,5 @@
 
 // ==================== EDIT (form) ====================
-router.get('/:slug/edit', requireGod, (req, res) => {
+router.get('/:slug/edit', requireSiteManagerBySlug, (req, res) => {
   const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(req.params.slug);
   if (!site) return res.redirect('/admin/sites?error=Not+found');
@@ -242,5 +242,5 @@
 
 // ==================== SAVE ====================
-router.post('/:slug/save', requireGod, (req, res) => {
+router.post('/:slug/save', requireSiteManagerBySlug, (req, res) => {
   const site = db.prepare('SELECT id FROM sites WHERE slug = ?').get(req.params.slug);
   if (!site) return res.redirect('/admin/sites?error=Not+found');