Add nonces for security

dry up redundencies

includes/class-hssm-main.php

@@ -175,8 +175,6 @@ class HSSM_Main {
         
         // AJAX hooks for authenticated users
         // Note: Main AJAX handlers are in HSSM_Frontend class
-        add_action( 'wp_ajax_hssm_upload_image', array( $this, 'ajax_upload_image' ) );
-        add_action( 'wp_ajax_hssm_preview_slides', array( $this, 'ajax_preview_slides' ) );
         add_action( 'wp_ajax_hssm_send_preview_email', array( $this, 'ajax_send_preview_email' ) );
         
         // Cron hooks for scheduled slides
@@ -352,6 +350,15 @@ class HSSM_Main {
      * @since 1.0.0
      */
     public static function activate() {
+        // Create custom capability
+        $roles = [ 'administrator', 'editor' ];
+        foreach ( $roles as $role_name ) {
+            $role = get_role( $role_name );
+            if ( $role ) {
+                $role->add_cap( 'hssm_manage_slides' );
+            }
+        }
+
         // Set up cron jobs
         self::setup_cron_jobs();
         
@@ -371,6 +378,15 @@ class HSSM_Main {
      * @since 1.0.0
      */
     public static function deactivate() {
+        // Remove custom capability
+        $roles = [ 'administrator', 'editor' ];
+        foreach ( $roles as $role_name ) {
+            $role = get_role( $role_name );
+            if ( $role ) {
+                $role->remove_cap( 'hssm_manage_slides' );
+            }
+        }
+        
         // Clear cron jobs
         wp_clear_scheduled_hook( 'hssm_check_scheduled_slides' );