Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/accounting/api/engine/get_gl_by_source.php

@@ -8,6 +8,7 @@ $doc_type  = trim((string)($data['doc_type']  ?? ''));
 $source_id = (int)($data['source_id'] ?? 0);
 
 if (!$doc_type || $source_id <= 0) {
+    http_response_code(400);
     $answer['message'] = 'doc_type and source_id required.';
     exit(json_encode($answer));
 }
@@ -27,8 +28,13 @@ try {
 
     $answer['success'] = 1;
     $answer['output']  = $detail;
+} catch (PDOException $e) {
+    error_log('[' . basename(__FILE__) . '] ' . $e->getMessage());
+    $answer['message'] = 'Database error, please try again.';
+    http_response_code(500);
 } catch (Exception $e) {
     $answer['message'] = $e->getMessage();
+    http_response_code(400);
 }
 
 exit(json_encode($answer));