feat: roles SPA foundations

docs/api.md

@@ -488,7 +488,7 @@ Each action reads its own permission: publish does not imply update, update does
 means `created_by` equals the caller; an unattributed item (`created_by` 0) is owned by nobody. A permission
 can also be set for one content type (`content.update:blog`, `content.update:article` for articles); that
 row replaces the wildcard for the type, whether it lowers or raises it, and a `none` row denies. Only the
-wildcard applies to a type with no row. An id that does not exist is 404 even for a caller at `own`.
+wildcard applies to a type with no row. An id that does not exist is 404 even for a caller at `own`. Article responses expose `created_by` to signed-in callers and API keys only (never to anonymous callers), so a client can tell which rows are its own; see `docs/api/articles.md`.
 
 A refusal is 403 `missing_permission` with `X-Missing-Permission` set to the base key (`content.update`,
 never `content.update:blog`). The permission is checked before the id and the body are read, then the scope

docs/api/articles.md

@@ -72,6 +72,7 @@ Breaking change: the default used to be HTML. Clients that need HTML must send `
   "body_format": "markdown",
   "is_online": true,
   "site_id": 1,
+  "created_by": 1,
   "authors": [],
   "slug": "backyard-renovation-update",
   "excerpt": "",
@@ -90,6 +91,8 @@ Breaking change: the default used to be HTML. Clients that need HTML must send `
 }
 ```
 
+`created_by` is the id of the user who created the article (`0` when it is attributed to nobody). It is present on every article object (list, read, create and update responses) only when the caller is signed in with a verified session or authenticates with an API key; the key acts as its creator. Anonymous callers, and unverified or stale sessions, get the same object without the field. The SPA reads it to decide which rows a role limited to `own` can edit, delete or publish.
+
 Every single-article read (`GET /v1/article/{id}`, `POST`, `PATCH`, `publish`, `unpublish`) carries the twelve SEO fields. Each item of `GET /v1/article/` carries `slug` and `excerpt` only, and none of the other ten.
 
 ## SEO fields