feat: more role backend and admin/writer roles additions and adjustments

features/user_roles.feature

@@ -1,4 +1,5 @@
 Feature: Users have a role, owner or admin, and only the owner can invite
+  Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
 
   As the person who registered the workspace
   I want my account to be the owner and everyone I invite to be an admin
@@ -22,7 +23,7 @@ Feature: Users have a role, owner or admin, and only the owner can invite
       created_at; invite items are unchanged: id, kind, email, status, created_at
     And POST /v1/user/invite is owner-only: after the jwt, current-token and verified checks, a
       RequireOwner check loads the user with GetUserUseCase and refuses any role other than
-      "owner" with 403 and the plain-text body apperr.OwnerRequiredErrorMessage
+      "owner" with 403 and the plain-text body apperr.MissingPermissionErrorMessage
       "Only the owner can do this.", before the rate limiter, the body decoding and the validation
     And GET /v1/user/ stays open to every verified user, owner and admin alike
     And error responses are plain text from http.Error, success responses are JSON
@@ -82,7 +83,7 @@ Feature: Users have a role, owner or admin, and only the owner can invite
     Given a verified admin id 2 "jonas" and a valid jwt cookie for user id 2
     When the client sends POST /v1/user/invite with body {"email": "sam.oliveira@renew.example"}
     Then the response status is 403
-    And the response body is exactly apperr.OwnerRequiredErrorMessage, as plain text
+    And the response body is exactly apperr.MissingPermissionErrorMessage, as plain text
     And the invite repository is still empty
     And no email was sent