feat: more role backend and admin/writer roles additions and adjustments

features/api_keys.feature

@@ -1,4 +1,5 @@
 Feature: Developers authenticate against /v1 with named API keys instead of the jwt cookie
+  Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
 
   As a developer integrating with RenewCMS
   I want to create named API keys and send them as a Bearer token
@@ -115,7 +116,7 @@ Feature: Developers authenticate against /v1 with named API keys instead of the
     When the client sends POST /v1/api-key with body {"name": "sneaky", "user_id": 1, "role": "owner"}
     Then the response status is 201
     And the stored key belongs to user 2
-    And using that key on POST /v1/user/invite returns 403 with apperr.OwnerRequiredErrorMessage
+    And using that key on POST /v1/user/invite returns 403 with apperr.MissingPermissionErrorMessage
 
   Scenario Outline: Key management needs a verified real session
     Given <caller>
@@ -186,7 +187,7 @@ Feature: Developers authenticate against /v1 with named API keys instead of the
     Given an active key created by admin 2
     When the client sends POST /v1/user/invite with that key and body {"email": "new@example.com"}
     Then the response status is 403
-    And the response body is apperr.OwnerRequiredErrorMessage
+    And the response body is apperr.MissingPermissionErrorMessage
     And no invite exists
 
   Scenario Outline: A key that can't authenticate gets the same 401 as a bad jwt