feat: more role backend and admin/writer roles additions and adjustments

docs/api.md

@@ -45,7 +45,7 @@ key never reads the audit trail. Events are append-only; there is no `POST`, `PU
 
 | Route | Who | Purpose |
 | --- | --- | --- |
-| `GET /v1/activity` | Any verified user | Filtered, paged events. Owner and admin see every event; any other role is scoped to its own events, and `actor` set to someone else answers 403 "Only owners and admins can do this." |
+| `GET /v1/activity` | Any verified user | Filtered, paged events. A role with `activity.view` at all sees every event; a role at own is scoped to its own events, and `actor` set to someone else answers 403 `missing_permission`. |
 | `GET /v1/activity/summary` | Owner, admin | Counts for the range, the previous period, active people and seven-bucket series. |
 | `GET /v1/activity/export` | Owner, admin | The same filters as the list without `page` or `size`, as a `text/csv; charset=utf-8` attachment (`when,actor,action,target,outcome,source,ip`). Cells starting with `=`, `+`, `-` or `@` get a leading quote. |
 
@@ -59,7 +59,7 @@ are UTC. The list answers `{ items, total, page, size }`, newest first (`created
 90), `activity_retention_max_gb` (0 for no size limit), `activity_log_size_bytes`,
 `activity_last_cleanup_at` and `activity_last_cleanup_removed`. `PATCH /v1/settings` with
 `{"activity_retention_days": 30}`, `{"activity_retention_max_gb": 5}` or both is session only and
-owner only (403 "Only the owner can do this."); any other value answers 400. The daily cleanup
+needs `system.edit_retention` (403 `missing_permission`); any other value answers 400. The daily cleanup
 removes events past the age limit, then the oldest events until the log fits the size limit.
 Whichever limit is reached first wins.
 
@@ -138,8 +138,8 @@ dashes (`^[a-z0-9]+(-[a-z0-9]+)*$`) and never changes, `base_url` is `https` (or
 stripped, uniqueness is not enforced), `default_robots` is `index` (default) or `noindex`, `locale`
 is `null` or a tag such as `en` or `fr-CA` (an empty string means none) and `default_social_image_id`
 is `null` or the id of an image. Read access needs a verified session or an API key; every write is
-session only and owner only (403 "Only the owner can do this.", or "This action needs a real
-session." with a key). The role is checked before the body.
+session only and need `settings.manage_sites` (`settings.delete_site` for DELETE): 403 `missing_permission`, or "This action needs a real
+session." with a key. The role is checked before the body.
 
 | Route | Purpose |
 | --- | --- |
@@ -255,8 +255,8 @@ article is allowed and never blocks publishing.
 | `PATCH /v1/author/{id}` | owner or admin on any author; any verified session on the author linked to it; session only | Edit `name`, `slug`, `bio`, `avatar_id`, `website`, `social_links`, `user_id`. Absent fields are untouched, `avatar_id`, `website` and `user_id` accept `null`, `social_links` is replaced as a whole. `user_id` links or unlinks the account and is owner or admin only. |
 | `DELETE /v1/author/{id}?reassign_to={id\|none}` | owner or admin, session only | 204. An author credited on articles needs `reassign_to`: an author id (that author takes the deleted one's position and is never duplicated on an article) or `none` (the credit is removed). The move and the delete are one transaction. `reassign_to` is ignored when the author has no article. The linked account is untouched. |
 
-The role checks use the existing bodies: 403 "Only owners and admins can do this." for `POST /` and
-`DELETE`, 403 `author_rights` for a `PATCH` by an account that is not owner or admin on an author
+The role checks use the existing bodies: 403 `missing_permission` for `POST /` and
+`DELETE`, 403 `author_rights` for a `PATCH` by a role that holds `authors.edit` at own on an author
 that is not its own (or that sends `user_id`), and 403 "This action needs a real session." for a key.
 Errors are plain text whose body is exactly the token: 404 `author_not_found`, 404 `user_not_found`,
 409 `author_slug_taken`, 409 `author_has_articles`, 409 `user_already_linked`, 409
@@ -284,8 +284,7 @@ repoint the avatars of the merged copies and report it as `authors_updated`.
 
 ## Image variants
 Owners and admins manage named variants of the stored images. These routes are session only (no API
-key) and sit behind the verified-user check; any other role gets 403 "Only owners and admins can do
-this." Behaviour, caching and the public `?v=<name>` contract are in [image-variants.md](image-variants.md).
+key) and sit behind the verified-user check; a role without the needed permission gets 403 `missing_permission`. Behaviour, caching and the public `?v=<name>` contract are in [image-variants.md](image-variants.md).
 
 | Route | Purpose |
 | --- | --- |
@@ -358,6 +357,10 @@ this format." and 500 "Internal server error".
 Every error is a plain-text body with one sentence; the status is in the HTTP status line. The
 statuses are 400, 401, 403, 404, 409, 429 and 500. Messages are listed on the Integration page.
 
+A caller whose role lacks the permission a route needs gets 403 with the body `missing_permission` and the
+header `X-Missing-Permission` set to the permission key (for example `users.invite`). The role is read on
+every request, so an API key follows the current role of its creator.
+
 ## Notes
 - Images in `body` use paths like `/static/uploadedImages/<uuid>.png`. Prefix them with the base URL.
 - Browsers can call the API only from origins in the server's CORS setting.