Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/reports/api/engine_report/stock_movement.php

@@ -12,6 +12,7 @@
     $to_month     = $data['to_month']   ?? '';
 
     if (!$warehouse_id || !$from_month || !$to_month) {
+        http_response_code(400);
         $answer['message'] = 'warehouse_id, from_month, and to_month are required.';
         exit(json_encode($answer));
     }

app/reports/api/engine_report/stock_movement_sku.php

@@ -13,6 +13,7 @@
     $to_month     = $data['to_month']   ?? '';
 
     if (!$warehouse_id || !$product_sku || !$from_month || !$to_month) {
+        http_response_code(400);
         $answer['message'] = 'warehouse_id, product_sku, from_month, and to_month are required.';
         exit(json_encode($answer));
     }