Roles, part 3: a member cannot change forge settings, other accounts, the crew's standing instructions or releases, nor mint a token wider than their own #2303

Part of #673.

Done looks like:

• [ ] Each of these is refused to a non-admin with a 403 on the API and a plain line on the page: admin settings, another account, the crew's standing instructions, and releases.
• [ ] A token a member mints can only carry scopes over that member's own repositories and apps.
• [ ] Tests: a member tries each act and is refused, and an admin succeeds.

Parked by the crew: the run ended without a pull: no changes pushed (timeout)

Parked by the crew: the run ended without a pull: no changes pushed

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the run ended without a pull: no changes pushed (timeout)
2. the run ended without a pull: no changes pushed

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2384 (admin settings and releases), #2385 (other accounts and standing instructions) and #2386 (token scopes). Both runs timed out trying all of it in one go.