Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/setting/api/engine/search_users.php

@@ -3,6 +3,9 @@
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
+    // Admin data: owners and admins only; staff and viewers never see it.
+    require_role($user_role, ['owner', 'admin']);
+
     $keyword = trim($data['keyword'] ?? '');
     $um      = new UserManager($pdo1, $company_id, $user_id);