feat: more role backend and admin/writer roles additions and adjustments

features/invitations.qa.md

@@ -1,5 +1,7 @@
 # QA procedure: invitations
 
+> Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
+
 Package: `test` (black-box). New fakes must have unique type names across the package:
 `mockInviteRepo` (implements `invite.Repository` with an in-memory slice and a `failSwitch`),
 plus a `fixedClock` only if the use case takes one. Reuse `mockUserRepo` and `stubHasher`
@@ -50,7 +52,7 @@ plus a `fixedClock` only if the use case takes one. Reuse `mockUserRepo` and `st
     failing send -> `500` and no invite for that address remains.
 13. Auth table (`POST`): no cookie -> `401`; cookie of unverified user 8 -> `403`; cookie with stale
     `token_version` -> `401`; cookie of a verified admin (seeded with `Role: admin`) -> `403`, plain
-    text body exactly `apperr.OwnerRequiredErrorMessage`. Each asserts no invite and no mail.
+    text body exactly `apperr.MissingPermissionErrorMessage`. Each asserts no invite and no mail.
 14. Rate limit: limiter of 2 per minute, `RemoteAddr` `203.0.113.20:1234`, three valid POSTs -> `201`,
     `201`, `429`; third body is exactly `apperr.TooManyRequestsErrorMessage`, has `Retry-After`, and adds no
     invite or mail. `GET /` from the same address afterwards is not `429`.