Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/revenue/api/engine/update_quotation_status.php

@@ -9,6 +9,7 @@ $id     = (int)($data['id']          ?? 0);
 $action = $data['action_type']        ?? '';
 
 if (!$id || !$action) {
+    http_response_code(400);
     $answer['message'] = 'ID and action are required.';
     exit(json_encode($answer));
 }