refactor(users): migrate remaining ~20 is_staff/staff_role checks to is_staff_user

[mostlyvirtual]

Context

PR #154 introduced is_staff_user as the canonical staff classification property (covers staff_role, is_staff, and is_superuser). The PR migrated ticket views, and PR #174 (post-merge fixes) completed the migration for users/views.py, users/models.py methods, and the HTMX path. ~20 locations across the codebase still use the old ad-hoc pattern.

Remaining Locations

Decorators (security-critical — highest priority)

• apps/common/decorators.py:50 — staff_required
• apps/common/decorators.py:89 — staff_required_strict
• apps/common/decorators.py:110 — billing_staff_required
• apps/common/decorators.py:132 — support_staff_required
• apps/common/decorators.py:158 — customer_or_staff_required
• apps/common/decorators.py:175 — can_edit_proforma
• apps/common/decorators.py:187 — can_create_internal_notes
• apps/common/decorators.py:195 — can_view_internal_notes

Context processors / middleware

• apps/common/context_processors.py:144 — current_customer
• apps/common/context_processors.py:172 — navigation_dropdowns
• apps/common/middleware.py:761 — staff detection

Views

• apps/billing/views.py:325,327,459,461,582,584,789 — multiple staff checks + template context is_staff_user key uses request.user.is_staff
• apps/domains/views.py:69,309 — can_manage flags
• apps/provisioning/service_views.py:67,104 — can_manage flags
• apps/orders/views.py:1160 — staff check
• apps/settings/views.py:42-44 — local is_staff_user function that only checks is_staff, shadows model property

Serializers

• apps/api/tickets/serializers.py:155,167 — staff check

Notes

• The decorators are the most important — they gate every staff-only endpoint. billing_staff_required uses staff_role in allowed_roles without checking is_staff, while can_manage_financial_data requires is_staff=True first. These two enforcement paths should be aligned.
• settings/views.py defines a local function also named is_staff_user that shadows the model property — this should be deleted and replaced with lambda u: getattr(u, 'is_staff_user', False).
• Consider whether decorators should use user.is_staff_user directly or maintain role-specific checks (e.g., billing_staff_required only allows admin/billing/manager roles).