feat: more role backend and admin/writer roles additions and adjustments

features/invitations.feature

@@ -1,4 +1,5 @@
 Feature: A verified user can invite another person by email, and the users list shows users and open invites
+  Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
 
   As a member of the shared RenewCMS workspace
   I want to invite someone by email and see who has an account or a pending invite
@@ -11,7 +12,7 @@ Feature: A verified user can invite another person by email, and the users list
     And POST /v1/user/invite and GET /v1/user/ are mounted in NewUserRouter, inside the group that
       requires a valid jwt cookie, a current token_version and a verified user
     And POST /v1/user/invite additionally requires the owner role (403
-      apperr.OwnerRequiredErrorMessage for an admin); GET /v1/user/ is open to every verified user
+      apperr.MissingPermissionErrorMessage for an admin); GET /v1/user/ is open to every verified user
     And wherever a scenario has verified user id 7 post an invite, user 7 is the owner
     And an invite has an id, an email stored in lower case, a hashed code, an expires_at equal to
       its creation time plus 3 days, an invited_by user id, a nullable accepted_at and a created_at