feat: more role backend and admin/writer roles additions and adjustments

features/sites_backend.feature

@@ -1,4 +1,5 @@
 Feature: Sites backend, the owner manages sites and every article belongs to exactly one
+  Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
 
   As the owner of a RenewCMS installation
   I want to create, edit, delete and choose a default among several sites, and assign each article to one
@@ -14,7 +15,7 @@ Feature: Sites backend, the owner manages sites and every article belongs to exa
     And GET /v1/site/ accepts a session or an API key; every write is session-only and goes through RequireOwner, like PATCH /v1/settings
     And PATCH /v1/article/{id} with site_id stays callable with an API key
     And error responses are plain text from http.Error whose body is exactly the code token: site_key_taken, site_has_articles, default_site, key_immutable, invalid_site_url, invalid_locale, site_not_found, image_not_found, use_set_default, invalid_reassign
-    And a non-owner write answers 403 with the existing RequireOwner body "Only the owner can do this." (apperr.OwnerRequiredErrorMessage), with no owner_only token
+    And a non-owner write answers 403 with the existing RequireOwner body "Only the owner can do this." (apperr.MissingPermissionErrorMessage), with no owner_only token
     And a request body that cannot be decoded answers 400 with apperr.BodyErrorMessage ("The request cannot be processed due to a mismatch in the format of the body."), a malformed id answers 400 with apperr.IdUint32ErrorMessage, and a validate-tag failure answers 400 with the validator error text, like POST /v1/article
     And a missing article answers 404 "Article not found" (apperr.ArticleNotFoundErrorMessage)
     And the roles are "owner" and "admin" only, and a "verified" account is one with is_verified true