Add restricted guest role

docs/UX_Guidelines.md

@@ -126,7 +126,8 @@ When auth is enabled, an **auth gate** blocks the UI with:
 - Error message area (red `#ff6b6b`)
 - Role badge display
 
-Accounts may combine **Read**, **Control**, **Write**, and **Administrator** roles.
+**Guest** provides read-only station access and is exclusive. Non-Guest accounts
+may combine **Read**, **Control**, **Write**, and **Administrator** roles.
 Administrator implies all permissions.
 
 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
@@ -341,7 +342,7 @@ Routes are classified into three tiers:
 | Tier | Examples | Requirement |
 |---|---|---|
 | **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Read, Control, or Administrator role |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Guest, Read, Control, or Administrator role |
 | **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, radio-control POST routes | Control or Administrator role |
 | **Write** | Logbook access and bookmark mutations | Write or Administrator role |
 
@@ -354,8 +355,9 @@ Routes are classified into three tiers:
 
 ### 7.3 User Management
 
-Every authenticated account gets a Settings > Account tab for changing its own
-password. Only administrators get Settings > Users, where accounts can be
+Every authenticated non-Guest account gets a Settings > Account tab for changing
+its own password. Guest sees neither Account nor Users and both account-control
+APIs deny Guest sessions. Only administrators get Settings > Users, where accounts can be
 created, enabled/disabled, assigned multiple roles, given a new password, or
 removed. The final enabled administrator cannot be disabled, removed, or
 demoted. Account security changes revoke every active session for that account.