Power cycle force-stopped and started a template, which power on refuses.
A non-staff owner with is_delete could delete a template that the
template rule otherwise leaves to superusers and staff owners;
get_instance(perm_type="delete") now refuses it, and the page offers
Destroy by the same rule.
The documented rule held only for snapshots: an owner with is_change could
still resize a template, set its root password and SSH keys, change its
options and console settings. get_instance(perm_type="change") now
refuses a template to owners who are not staff, which covers every change
view and the API; the per-view snapshot checks it replaces are removed,
and the page offers those controls by the same rule. Viewing, the console,
power (a no-op on a template) and cloning are unchanged.
- The serial console cannot work until socketiod is rewritten (it does
not understand the signed console token), so the README no longer
describes how to enable it; only the hardening line for existing
installs is kept. The reverse-proxy example no longer sets
SOCKETIO_PUBLIC_PORT.
- Move the users, roles and permissions reference to doc/permissions.md
and link it from the README.
