fix(httpapi): phase 1 compliance — ERR-01, SEC-04, CDN client, scheduler docs

Co-authored-by: Cursor <[email protected]>

internal/httpapi/server_test.go

@@ -28,7 +28,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 	}
 	defer srv.Close()
 	tenant, modCDN, modIP, rev, speaker := srv.Store().DemoIDs()
-	srv.apiKeys = parseAPIKeysSpec("nodekey|" + tenant + "|node,opkey|" + tenant + "|operator")
+	srv.apiKeys = parseAPIKeysSpec("nodekey|" + tenant + "|node,opkey|" + tenant + "|operator,edkey|" + tenant + "|editor")
 
 	ts := httptest.NewServer(srv.Handler())
 	defer ts.Close()
@@ -247,6 +247,20 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		}
 	})
 
+	t.Run("rollback forbidden for editor", func(t *testing.T) {
+		req, _ := http.NewRequest(http.MethodPost, base+"/v1/revisions/"+rev+"/rollback", nil)
+		req.Header.Set("Authorization", "Bearer edkey")
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusForbidden {
+			b, _ := io.ReadAll(resp.Body)
+			t.Fatalf("status %d want 403: %s", resp.StatusCode, b)
+		}
+	})
+
 	t.Run("rollback queues job", func(t *testing.T) {
 		req, _ := http.NewRequest(http.MethodPost, base+"/v1/revisions/"+rev+"/rollback", nil)
 		req.Header.Set("Authorization", "Bearer opkey")