Add composable HTTP access roles

docs/UX_Guidelines.md

@@ -126,7 +126,8 @@ When auth is enabled, an **auth gate** blocks the UI with:
 - Error message area (red `#ff6b6b`)
 - Role badge display
 
-Two roles: **User** (read-only) and **Admin** (full access including user management).
+Accounts may combine **Read**, **Control**, **Write**, and **Administrator** roles.
+Administrator implies all permissions.
 
 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
 
@@ -340,8 +341,9 @@ Routes are classified into three tiers:
 | Tier | Examples | Requirement |
 |---|---|---|
 | **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | User or Admin role |
-| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Admin role only |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Read, Control, or Administrator role |
+| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, radio-control POST routes | Control or Administrator role |
+| **Write** | Logbook access and bookmark mutations | Write or Administrator role |
 
 ### 7.2 Session Management