fix: CustomField policies, no system-actor fallback, guidelines

- Tests and UI pass actor for CustomField create/read/destroy; seeds use actor
- Member required-custom-fields validation uses context.actor only (no fallback)
- CODE_GUIDELINES: add rule forbidding system-actor fallbacks

test/mv_web/components/member_filter_component_test.exs

@@ -16,8 +16,10 @@ defmodule MvWeb.Components.MemberFilterComponentTest do
 
   alias Mv.Membership.CustomField
 
-  # Helper to create a boolean custom field
+  # Helper to create a boolean custom field (uses system_actor - only admin can create)
   defp create_boolean_custom_field(attrs \\ %{}) do
+    system_actor = Mv.Helpers.SystemActor.get_system_actor()
+
     default_attrs = %{
       name: "test_boolean_#{System.unique_integer([:positive])}",
       value_type: :boolean
@@ -27,11 +29,13 @@ defmodule MvWeb.Components.MemberFilterComponentTest do
 
     CustomField
     |> Ash.Changeset.for_create(:create, attrs)
-    |> Ash.create!()
+    |> Ash.create!(actor: system_actor)
   end
 
-  # Helper to create a non-boolean custom field
+  # Helper to create a non-boolean custom field (uses system_actor - only admin can create)
   defp create_string_custom_field(attrs \\ %{}) do
+    system_actor = Mv.Helpers.SystemActor.get_system_actor()
+
     default_attrs = %{
       name: "test_string_#{System.unique_integer([:positive])}",
       value_type: :string
@@ -41,7 +45,7 @@ defmodule MvWeb.Components.MemberFilterComponentTest do
 
     CustomField
     |> Ash.Changeset.for_create(:create, attrs)
-    |> Ash.create!()
+    |> Ash.create!(actor: system_actor)
   end
 
   describe "rendering" do