Add composable HTTP access roles

docs/User-Manual.md

@@ -354,6 +354,9 @@ A name in any of those maps that no remote answers to is a config error.
 | `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
 | `bootstrap_admin_password` | string | — | First administrator password |
 | `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
+| `bootstrap_read_enabled` | bool | `true` | Create the default read-only account when the database is absent |
+| `bootstrap_read_username` | string | `"guest"` | Initial read-only username |
+| `bootstrap_read_password` | string | `"guest"` | Initial read-only password |
 | `session_ttl_min` | u64 | `480` | Session lifetime |
 | `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
 | `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |
@@ -577,7 +580,7 @@ The link button in the top bar copies the current link to the clipboard. The
 address bar itself is updated as you tune, using `replaceState`, so sweeping
 the dial does not fill the browser's history.
 
-Applying a link changes the radio, so it needs the `admin` role; a `user`
+Applying a link changes the radio, so it needs the `Control` role; a `Read`
 session opens the page and says the link was not applied. Links describe the
 rig's own dial — while a tab is listening to a virtual channel the address is
 left as it was, rather than publishing a frequency the rig is not on.
@@ -586,11 +589,13 @@ left as it was, rather than publishing a frequency the rig is not on.
 
 ## Authentication
 
-The HTTP frontend supports an optional user/password ACL with multiple accounts and two
-roles:
+The HTTP frontend supports an optional user/password ACL with multiple independent
+roles. One account may have any combination:
 
-- **user** — read-only access (monitoring, audio, decode streams)
-- **admin** — full radio control, settings, and user management
+- **Read** — monitoring, audio, decode streams, and bookmark reads
+- **Control** — full radio receive/transmit controls
+- **Write** — logbook access and bookmark changes
+- **Administrator** — user management and all other permissions
 
 ### Configuration
 
@@ -600,6 +605,9 @@ enabled = false
 users_file = "trx-http-users.json"
 bootstrap_admin_username = "admin"
 bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false      # true if served via HTTPS
 cookie_same_site = "Lax"   # Strict|Lax|None
@@ -607,7 +615,9 @@ cookie_same_site = "Lax"   # Strict|Lax|None
 
 When `enabled = false` (the default), all auth is bypassed and the UI behaves
 as before. When enabling it for the first time, bootstrap credentials create
-the initial administrator and the Argon2id-hashed user database.
+the initial administrator (with every role), the default `guest`/`guest` Read
+account, and the Argon2id-hashed user database. Change or disable the guest
+credentials in configuration before first startup on an exposed deployment.
 
 ### Behaviour
 
@@ -615,8 +625,9 @@ the initial administrator and the Argon2id-hashed user database.
 - Sessions are in-memory; a server restart invalidates all sessions.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
 - User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
-- `user` sessions cannot call control routes. There is no guest-access mode.
-- Administrators can add/remove users and change roles/passwords in Settings.
+- Roles are independent; for example, an account may have Read and Write without Control.
+- Administrators can add/remove users and change roles/passwords in Settings > Users.
+- At least one administrator must always remain and cannot be removed or demoted.
 - Removing an account or changing its password/role revokes its sessions.
 
 ### Routes
@@ -625,19 +636,19 @@ the initial administrator and the Argon2id-hashed user database.
 |----------|--------|-------------|
 | `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
-| `/auth/session` | GET | Check current session/role |
+| `/auth/session` | GET | Check current session/roles |
 | `/auth/users` | GET/POST | List or add users (admin only) |
-| `/auth/users/{username}` | PATCH/DELETE | Change password/role or remove user (admin only) |
+| `/auth/users/{username}` | PATCH/DELETE | Change password/roles or remove user (administrator only) |
 
-Protected routes require at least `user` role. Control routes (set frequency,
-mode, PTT, etc.) require `admin` role.
+Read routes require Read. Radio mutations require Control. Logbook access and
+bookmark mutations require Write. Administrator grants every permission.
 
 ### Frontend Flow
 
 1. On load, the UI calls `/auth/session`.
 2. If unauthenticated, a login screen is shown.
 3. On successful login, the normal UI loads.
-4. `user` accounts see a read-only interface; admins get full controls.
+4. The interface enables controls according to the account's roles.
 5. If a session expires mid-use, streams stop and the login screen returns.
 
 ### Transport Security