[feature] multiple levels of access control?

**Version and OS**
N/A

**Is your feature request related to a problem? Please describe.**
Currently, we are only able to choose to set a password to restrict access to the dashboard. A visitor will either have full read and edit access to the dashboard (including changing sitewide configurations) if they know the password or no password is set, or have completely no access.

**Describe the solution you'd like**

For a simple version, we may have roles such as
* `owner`: with full access to all features, including changing sitewide configurations
* `collaborator`: have view access and also able to `recheck` and change some of the entries that are allowed to be edited, but not the website configurations
* `view`: only have view access

**Describe the use-case and give concrete real-world examples**
When we want to share the monitoring results on the website with some people, but don't want them to modify the rules or accidentally delete an entry, the `view` role would be quite useful. And sometimes we don't want to let the `collaborator` change sitewide configurations and we want to protect some entries from editing.

**Additional context**
I am quite open-minded. Just want to start the discussion. Anything is better than the current all-or-nothing access control.

The issue names no files, tests, or entry points. Begin by clarifying the proposed roles, permissions, protected settings, and migration behavior before locating the existing password access-control implementation. Done would require an agreed access model, implemented enforcement, and tests covering owner, collaborator, and view permissions.

Written by the indexing model from the issue text.