Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/inventory/api/engine/manage_product.php

@@ -37,6 +37,7 @@
             $errors = $uploader->upload('product_image');
             if (!empty($errors)) {
                 $answer['success'] = 0;
+                http_response_code(400);
                 $answer['message'] = $errors[0];
                 exit(json_encode($answer));
             }

app/inventory/api/engine/manager.php

@@ -9,8 +9,13 @@
         $users = new UserManager($pdo1, $company_id, $user_id);
         $answer['output'] = $users->getCompanyUsers();
         $answer['success'] = 1;
+    } catch (PDOException $e) {
+        error_log('[' . basename(__FILE__) . '] ' . $e->getMessage());
+        $answer['message'] = 'Database error, please try again.';
+        http_response_code(500);
     } catch (Exception $e) {
         $answer['message'] = $e->getMessage();
+        http_response_code(400);
     }
 
     exit(json_encode($answer));