feat: more role backend and admin/writer roles additions and adjustments

features/invite_management.qa.md

@@ -1,5 +1,7 @@
 # QA procedure: invite management
 
+> Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
+
 Package: `test` (black-box). Reuse `mockUserRepo`, `stubHasher`, `mockMailRepo` and `mockInviteRepo`.
 Extend `mockInviteRepo` with the new renew method and a `failSwitch` entry for it (unique type names
 across the package). No live server, no real SQLite (except case 27), no real SMTP.
@@ -45,7 +47,7 @@ across the package). No live server, no real SQLite (except case 27), no real SM
 
 ## Access and ids (table over both endpoints)
 22. No cookie -> `401`; stale `token_version` -> `401`; unverified -> `403`; admin -> `403` with body
-    `apperr.OwnerRequiredErrorMessage`; admin on an unknown id -> `403`. Each: invite unchanged, no mail.
+    `apperr.MissingPermissionErrorMessage`; admin on an unknown id -> `403`. Each: invite unchanged, no mail.
 23. Ids `abc`, `-1`, `4294967296` -> `400` `apperr.IdUint32ErrorMessage` on both endpoints.
 
 ## Rate limit