feat: more role backend and admin/writer roles additions and adjustments

features/updates_restart_helper.feature

@@ -1,4 +1,5 @@
 Feature: Updates part 3: Restart, the privileged helper and rollback
+  Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
 
   As the owner of a RenewCMS site
   I want one Restart button that installs the staged release, or just restarts the site, and puts the old version back if the new one does not come up
@@ -122,7 +123,7 @@ Feature: Updates part 3: Restart, the privileged helper and rollback
       | no jwt cookie         | 401    | the existing 401 text            |
       | a stale token version | 401    | the existing 401 text            |
       | an unverified owner   | 403    | the existing unverified text     |
-      | an admin              | 403    | apperr.OwnerRequiredErrorMessage |
+      | an admin              | 403    | apperr.MissingPermissionErrorMessage |
 
   Scenario Outline: Restart is refused with 409
     Given the owner and <condition>