Rethink owner role

Owner can do almost everything, but not quite (e.g. audit-log api is only for reporter). Some ideas:

- write logic in the `:roles` handler that allows owner to do anything. Then we wouldn't need to mention `:owner` ever in `:roles`
- consider creating another role, `:admin` for example, that can only access admin APIs

Start by reviewing the `:roles` handler and the audit-log API access rules mentioned in the issue. The issue presents alternatives rather than a decided scope, so completion would first require an agreed role model and clear authorization behavior for owners, reporters, and any admin role.

Written by the indexing model from the issue text.