[feat](trx-frontend-http): separate transmit permission

Assisted-By: Codex (GPT-5)
Signed-off-by: Stan Grams <sjg@haxx.space>

docs/User-Manual.md

@@ -593,7 +593,8 @@ The HTTP frontend supports an optional user/password ACL:
 
 - **Guest** — read-only station access with no Account or Users controls; Guest cannot be combined with another role
 - **Read** — monitoring, audio, decode streams, and bookmark reads
-- **Control** — full radio receive/transmit controls
+- **Control** — tuning, mode, power, and receive-side radio controls
+- **Transmit** — PTT, transmitted audio, and TX power-limit controls
 - **Write** — logbook access and bookmark changes
 - **Administrator** — user management and all other permissions
 
@@ -644,8 +645,9 @@ credentials in configuration before first startup on an exposed deployment.
 | `/auth/users` | GET/POST | List or add users (admin only) |
 | `/auth/users/{username}` | PATCH/DELETE | Change enabled state/password/roles or remove user (administrator only) |
 
-Read routes accept Guest or require Read. Radio mutations require Control. Logbook access and
-bookmark mutations require Write. Administrator grants every permission.
+Read routes accept Guest or require Read. Tuning and receive-side radio mutations
+require Control. PTT, transmitted audio, and TX limit changes require Transmit.
+Logbook access and bookmark mutations require Write. Administrator grants every permission.
 
 ### Frontend Flow