feat: more role backend and admin/writer roles additions and adjustments

features/integration_api_key_routes.qa.md

@@ -1,5 +1,7 @@
 # QA procedure: Integration page, every API-key route documented
 
+> Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
+
 No Go test: SPA only, no /v1 call, no API change. Samples and counts follow the real API; where the board differs (purge response, built-in type samples) the API wins.
 
 ## Automated SPA (Vitest + Vue Test Utils, `task test:web`)