Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/accounting/api/engine/manage_department.php

@@ -6,6 +6,7 @@ require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 require_role($user_role, ['owner', 'admin']);
 
 if (empty($data['dept_code']) || empty($data['dept_name'])) {
+    http_response_code(400);
     $answer['message'] = 'Department code and name are required';
     exit(json_encode($answer));
 }