Permissions: Add `server.can_admin` permission and check on `/server`