feat: more role backend and admin/writer roles additions and adjustments

features/api_keys.qa.md

@@ -1,5 +1,7 @@
 # QA procedure: API keys
 
+> Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
+
 Package: `test` (black-box). No live server, no real SQLite file, no real SMTP.
 
 ## Setup shared by every case
@@ -38,7 +40,7 @@ Package: `test` (black-box). No live server, no real SQLite file, no real SMTP.
     "yesterday" -> `400` `BodyErrorMessage`; past `expires_at` -> `400` `apperr.APIKeyExpiryErrorMessage`.
     Each: repository still empty.
 12. Body `{"name":"sneaky","user_id":1,"role":"owner"}` with admin 2 -> `201`; stored `UserID` 2; that
-    key on `POST /v1/user/invite` -> `403` `apperr.OwnerRequiredErrorMessage`, no invite.
+    key on `POST /v1/user/invite` -> `403` `apperr.MissingPermissionErrorMessage`, no invite.
 13. Access table: no credentials -> `401`; user 4 cookie -> `403` `apperr.VerificationRequiredErrorMessage`;
     stale `token_version` -> `401`. Each: repository empty.
 
@@ -59,7 +61,7 @@ Package: `test` (black-box). No live server, no real SQLite file, no real SMTP.
     `200`. No credentials -> list has only 6, `GET /5` is `404`. `Bearer rcms_unknown` on `GET /v1/article`
     -> `401` `apperr.UnauthorizedErrorMessage`.
 18. Owner key `POST /v1/user/invite` -> `201`, `invited_by` 1. Admin key -> `403`
-    `apperr.OwnerRequiredErrorMessage`, no invite and no mail.
+    `apperr.MissingPermissionErrorMessage`, no invite and no mail.
 19. Table of 401 cases on `GET /v1/settings`, all with body `apperr.UnauthorizedErrorMessage` exactly (the
     stored-hash case has no `rcms_` prefix, so it takes the jwt path: assert status `401` only):
     unknown well-formed key; expired (clock one second past `expires_at`); revoked; creator deleted from