Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/accounting/api/engine/post_gl_entry.php

@@ -30,6 +30,7 @@ $posting_map = [
 ];
 
 if (!isset($posting_map[$doc_type]) || $id <= 0) {
+    http_response_code(400);
     $answer['message'] = 'Invalid doc_type or id.';
     exit(json_encode($answer));
 }
@@ -73,9 +74,15 @@ try {
         'has_expense' => $has_expense,
     ], $company_id);
 
+} catch (PDOException $e) {
+    if ($pdo2->inTransaction()) $pdo2->rollBack();
+    error_log('[' . basename(__FILE__) . '] ' . $e->getMessage());
+    $answer['message'] = 'Database error, please try again.';
+    http_response_code(500);
 } catch (Exception $e) {
     if ($pdo2->inTransaction()) $pdo2->rollBack();
     $answer['message'] = $e->getMessage();
+    http_response_code(400);
 }
 
 exit(json_encode($answer));