feat: more role backend and admin/writer roles additions and adjustments

features/updates_release_feed.feature

@@ -1,4 +1,5 @@
 Feature: Updates part 1: signed releases, release feed and read-only update notification
+  Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
 
   As the owner of a RenewCMS site
   I want to see when a newer signed release exists, and have admins see the same status read-only
@@ -142,7 +143,7 @@ Feature: Updates part 1: signed releases, release feed and read-only update noti
   Scenario: An admin cannot check
     Given the caller is an admin
     When the client sends POST /v1/system/update/check
-    Then the status is 403 and the body is apperr.OwnerRequiredErrorMessage
+    Then the status is 403 and the body is apperr.MissingPermissionErrorMessage
     And the feed is not contacted
 
   Scenario: Feed failure keeps the last result