feat(admin): control player quest commands

knowledge/log.md

@@ -69,3 +69,10 @@ description: Chronological record of material decisions affecting Spigot Quest B
 - Inventory overflow drops at the claimant's feet with ownership protection, and failed claim acknowledgement rolls inventory and drops back before retry.
 - Added persisted online and next-login expiry notifications.
 - Verified 73 tests and the plugin JAR with `./gradlew clean check jar`.
+
+## 2026-09-05 — Administrative player-command control
+
+- Disabled all player `/quests` command forms and autocomplete by default while preserving equivalent physical-board actions.
+- Added persistent `/questadmin commands enable|disable` control with permission-aware autocomplete and failure-safe updates.
+- Kept administrative board creation available independently of the player-command setting.
+- Verified 82 tests and the plugin JAR with `./gradlew clean check jar`.

knowledge/user-stories/us-008-control-player-quest-commands.md

@@ -2,7 +2,7 @@
 type: User Story
 title: "US-008: Control player quest commands"
 description: Let administrators require physical-board interaction by controlling access to player quest commands.
-status: backlog
+status: done
 ---
 
 # US-008: Control player quest commands
@@ -11,14 +11,14 @@ As an **administrator**, I want to enable or disable player quest commands so th
 
 ## Acceptance criteria
 
-- [ ] Player `/quests` commands are disabled by default.
-- [ ] An authorized administrator can use `/questadmin commands enable|disable` with contextual autocomplete.
-- [ ] The command setting persists across server restarts.
-- [ ] When disabled, `/quests`, `list`, `create`, `complete`, `cancel`, and `claim` reject execution with a clear message directing the player to a quest board.
-- [ ] Disabling commands does not prevent any equivalent action through a registered board.
-- [ ] `/questadmin` remains available to authorized administrators regardless of the player-command setting.
-- [ ] Unauthorized users cannot change the setting.
-- [ ] Automated tests verify the default, persistence, authorization, every gated subcommand, and autocomplete.
+- [x] Player `/quests` commands are disabled by default.
+- [x] An authorized administrator can use `/questadmin commands enable|disable` with contextual autocomplete.
+- [x] The command setting persists across server restarts.
+- [x] When disabled, `/quests`, `list`, `create`, `complete`, `cancel`, and `claim` reject execution with a clear message directing the player to a quest board.
+- [x] Disabling commands does not prevent any equivalent action through a registered board.
+- [x] `/questadmin` remains available to authorized administrators regardless of the player-command setting.
+- [x] Unauthorized users cannot change the setting.
+- [x] Automated tests verify the default, persistence, authorization, every gated subcommand, and autocomplete.
 
 ## Related