Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/setting/api/engine/stock_maintenance.php

@@ -36,6 +36,7 @@ try {
     if ($action === 'get_periods') {
         $warehouse_id = (int)($data['warehouse_id'] ?? 0);
         if (!$warehouse_id) {
+            http_response_code(400);
             $answer['message'] = 'warehouse_id is required.';
             exit(json_encode($answer));
         }
@@ -48,6 +49,7 @@ try {
         $warehouse_id = (int)($data['warehouse_id'] ?? 0);
         $period       = $data['period'] ?? '';
         if (!$warehouse_id || !preg_match('/^\d{4}-\d{2}$/', $period)) {
+            http_response_code(400);
             $answer['message'] = 'Valid warehouse_id and period (YYYY-MM) are required.';
             exit(json_encode($answer));
         }