feat: more role backend and admin/writer roles additions and adjustments

features/user_roles.qa.md

@@ -1,5 +1,7 @@
 # QA procedure: user_roles
 
+> Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.
+
 Package: `test` (black-box). Reuse `mockUserRepo`, `stubHasher`, `mockMailRepo`, `mockInviteRepo`.
 No live server, no real SQLite file, no real SMTP.
 
@@ -34,7 +36,7 @@ No live server, no real SQLite file, no real SMTP.
 
 ## POST /v1/user/invite
 13. Owner cookie, valid body -> 201, one invite, one "invitation" mail.
-14. Admin cookie, valid body -> 403, body exactly `apperr.OwnerRequiredErrorMessage`, `Content-Type`
+14. Admin cookie, valid body -> 403, body exactly `apperr.MissingPermissionErrorMessage`, `Content-Type`
     is not JSON-decoded (plain text), no invite, no mail.
 15. Admin cookie with `{"email":"not-an-email"}` and with `not json` -> 403 both.
 16. Rate limit 2: admin sends 3 requests -> 403, 403, 403.