Make changing engine-run code superuser-only

Writing node source, installing modules and any flow save that adds,
retypes or repoints a code node (Function, Command), edits a Command
node's settings or changes a node's resources.env now answer 403 for
everyone but a superuser. MCP tools and the assistant reach the same
routes, so they inherit the gate. Node types report runs_code.

The editor shows code read-only with a note, disables a Command node's
settings, leaves code nodes and reusable nodes out of the palette and
paste, and the Modules page offers no install.

docs/code/api.md

@@ -62,6 +62,12 @@ curl -X PUT $FLUKSIO/flows/house/nodes/decide/source -H "Authorization: Bearer $
   -H 'Content-Type: application/json' -d '{"code": "def process(x):\n    return {\"y\": x * 2}\n"}'
 ```
 
+Writing a source is a superuser's, and so is any `PUT /flows/{name}` that
+adds a Function or Command node, retypes or repoints one, changes a Command
+node's settings, or changes any node's `resources.env`: each of them is code
+the engine runs. Anyone else gets a 403 and keeps the rest — wiring, titles,
+a Function node's settings and every other node.
+
 `POST .../share` promotes a node's source to the shared library;
 `POST .../unshare` gives it a private copy back. `GET /flows/library` lists the
 shared sources and which flows use each.
@@ -197,7 +203,7 @@ curl -X POST $FLUKSIO/alerts/test/my-phone -H "Authorization: Bearer $TOKEN"
 ```
 
 Secrets are write-only over the API: you can list names and set values, never
-read one back.
+read one back. Secrets and `POST /modules/apply` are a superuser's.
 
 ## Observability