Bug: Restrict verification-request access to staff

### Background Information
The `verification-request` route/feature is currently accessible to unauthorized users. Access should be restricted to staff members only.

### Steps to Reproduce
1. Authenticate as a regular (non-staff) user
2. Attempt to access the `verification-request` endpoint or page
3. Observe that access is incorrectly granted

### How
Add a permission check (guard/middleware) to ensure only users with a staff role can access `verification-request` resources.

### Expected Behavior
Non-staff users should receive a `403 Forbidden` error when attempting to access `verification-request`.

Start by locating the `verification-request` route or page and inspect nearby permission guards or middleware. Reproduce the access with a regular user, then verify that staff users retain access while non-staff users receive a `403 Forbidden` response.

Written by the indexing model from the issue text.