fix(docs): secure adaptive handbook projections

src/govoplan_docs/backend/manifest.py

@@ -14,7 +14,9 @@ from govoplan_core.core.modules import (
 )
 
 DOCS_READ_SCOPE = "docs:documentation:read"
-DOCS_READ_SCOPES = (DOCS_READ_SCOPE, "system:settings:read", "admin:settings:read")
+DOCS_ADMIN_READ_SCOPE = "docs:documentation:admin"
+DOCS_ADMIN_READ_SCOPES = (DOCS_ADMIN_READ_SCOPE, "system:settings:read", "admin:settings:read")
+DOCS_READ_SCOPES = (DOCS_READ_SCOPE, *DOCS_ADMIN_READ_SCOPES)
 
 
 def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
@@ -41,14 +43,19 @@ def _route_factory(context: ModuleContext):
 manifest = ModuleManifest(
     id="docs",
     name="Docs",
-    version="0.1.8",
+    version="0.1.9",
     required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
     optional_dependencies=("policy", "audit", "ops", "workflow", "search"),
     permissions=(
         _permission(
             DOCS_READ_SCOPE,
             "View configured documentation",
-            "Read documentation generated from installed modules, visible routes, permissions, and evidence sources.",
+            "Read user documentation generated for the current actor from installed modules and effective configuration.",
+        ),
+        _permission(
+            DOCS_ADMIN_READ_SCOPE,
+            "View administrative documentation",
+            "Read technical module, route, permission, configuration, and evidence documentation.",
         ),
     ),
     role_templates=(
@@ -58,6 +65,12 @@ manifest = ModuleManifest(
             description="Read the configured-system documentation browser.",
             permissions=(DOCS_READ_SCOPE,),
         ),
+        RoleTemplate(
+            slug="docs_admin",
+            name="Documentation administrator",
+            description="Read user guidance and the technical configured-system documentation projection.",
+            permissions=(DOCS_READ_SCOPE, DOCS_ADMIN_READ_SCOPE),
+        ),
     ),
     route_factory=_route_factory,
     nav_items=(NavItem(path="/docs", label="Docs", icon="reports", required_any=DOCS_READ_SCOPES, order=880),),