feat: more role backend and admin/writer roles additions and adjustments

features/updates_release_feed.qa.md

@@ -1,5 +1,7 @@
 # QA: Updates part 1 (signed releases, release feed, notification)
 
+> Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
+
 ## Automated Go (`task test`, package `test`, black-box)
 
 Files: `test/update_test.go` (domain, use cases), `test/update_http_test.go` (HTTP), `test/update_feed_test.go`
@@ -24,7 +26,7 @@ server, no SQLite, no SMTP.
    `apperr.VerificationRequiredErrorMessage`.
 6. `POST /v1/system/update/check` as owner: 200, store updated with latest, `release_url` and `checked_at`, feed called
    once, a later GET equals it. Nothing newer: `available` false. Running version "dev": `available` false.
-7. POST check as admin: 403, body `apperr.OwnerRequiredErrorMessage+"\n"`, feed not called.
+7. POST check as admin: 403, body `apperr.MissingPermissionErrorMessage+"\n"`, feed not called.
 8. Feed error: 500, store unchanged (latest and `checked_at` as before), body contains no feed error text.
 9. Rate limit: owner A sends 6 checks: first 5 are 200, the 6th is 429 with `apperr.TooManyRequestsErrorMessage+"\n"`
    and an integer `Retry-After` of at least 1; feed called 5 times; owner B's first check still 200; a login-limiter