Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/accounting/api/engine/get_gl_movement.php

@@ -12,6 +12,7 @@ $to_date      = trim((string)($data['to_date']      ?? ($data['to_period']   ??
 $dept_id      = (int)($data['department_id'] ?? 0);
 
 if ($account_code === '') {
+    http_response_code(400);
     $answer['message'] = 'account_code is required.';
     exit(json_encode($answer));
 }