Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/accounting/api/engine/retrieve_account.php

@@ -5,6 +5,7 @@ require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 
 $id = (int)($data['id'] ?? 0);
 if (!$id) {
+    http_response_code(400);
     $answer['message'] = 'Missing id';
     exit(json_encode($answer));
 }
@@ -12,6 +13,7 @@ if (!$id) {
 $coa = new ChartOfAccounts($pdo2, $company_id);
 $row = $coa->getById($id);
 if (!$row) {
+    http_response_code(404);
     $answer['message'] = 'Account not found';
     exit(json_encode($answer));
 }