Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/accounting/api/engine/acquire_op_lock.php

@@ -3,6 +3,9 @@ require_once __DIR__ . '/../../../session.php';
 require_once '../../../assets/utils/db_auth.php';
 require_once '../../../assets/utils/classes/OperationLockManager.php';
 
+// Batch GL posting takes this lock; posting itself is owner/admin only.
+require_role($user_role, ['owner', 'admin']);
+
 try {
     $lock_manager = new OperationLockManager($pdo2, $company_id, $user_id);
     $result = $lock_manager->acquire(
@@ -10,7 +13,15 @@ try {
         (int)($data['ttl_minutes'] ?? 120)
     );
     $answer = array_merge($answer, $result);
+    if (empty($result['success'])) {
+        http_response_code(409); // another tab or user holds the lock
+    }
+} catch (PDOException $e) {
+    error_log('[acquire_op_lock] ' . $e->getMessage());
+    http_response_code(500);
+    $answer['message'] = 'Database error, please try again.';
 } catch (Exception $e) {
+    http_response_code(400);
     $answer['message'] = $e->getMessage();
 }