Make changing engine-run code superuser-only

Writing node source, installing modules and any flow save that adds,
retypes or repoints a code node (Function, Command), edits a Command
node's settings or changes a node's resources.env now answer 403 for
everyone but a superuser. MCP tools and the assistant reach the same
routes, so they inherit the gate. Node types report runs_code.

The editor shows code read-only with a note, disables a Command node's
settings, leaves code nodes and reusable nodes out of the palette and
paste, and the Modules page offers no install.

docs/interface/flow-editor.md

@@ -80,6 +80,10 @@ reloads without the flow stopping. A node file defines `process(...)`; if it
 defines exactly one public function under another name, that one is used
 instead.
 
+Code runs as the engine, so changing it is a superuser's. Anyone else sees the
+editor read-only, a Command node's settings disabled, and no Function, Command
+or reusable nodes to add.
+
 **Shared** turns a node's code into a library entry other flows can reuse.
 Editing a shared node edits the copy every flow using it runs, which is the
 point and also the caution.

docs/interface/operations.md

@@ -39,7 +39,8 @@ Node code runs in a virtual environment of its own, on the instance's data
 volume, separate from the packages Fluksio itself runs on. A pin of yours can
 never shadow one of ours, and vice versa.
 
-**Modules** is a pip manifest and an **Apply** button. It is installed with
+**Modules** is a pip manifest and an **Apply** button, which only a superuser
+sees: a package runs its own code on install. It is installed with
 `uv pip sync`, so a line you delete is uninstalled rather than left behind.
 The manifest is versioned alongside your flows, so what a deployment installed
 is recorded with what uses it.
@@ -114,7 +115,7 @@ is a superuser.
 
 Accounts that arrived through a portal are badged *Portal*. They have no
 password (they sign in at the portal, not here) and they are never
-superusers. Deleting one cuts their access immediately and independently of the
+superusers, so they read node code but cannot change it. Deleting one cuts their access immediately and independently of the
 portal, so it works even if the portal cannot be reached. See
 [Accounts and the portal](portal.md).