Document the Superadministrator role and restricted settings (Track D)

Explains, in the administrator guide, that the Catalog Server, Intranet
parameters and Proxy server settings can only be edited by a
Superadministrator (Administrator retains view access), that a direct API
attempt to change them is rejected with 403 and nothing saved, and adds a
Superadministrator entry to the profile list and role matrix notes.

Author: Jose Garcia

docs/manual/docs/administrator-guide/configuring-the-catalog/system-configuration.md

@@ -6,6 +6,10 @@ Most of the system configuration parameters can be changed by administrator user
 
     Configuration of these parameters is critically important for the catalog in an operational context. Misunderstanding some settings may result in a system that does not function as expected. For example, downloads may fail to be correctly processed, or metadata harvesting from other servers may not work.
 
+!!! note "Superadministrator-only settings"
+
+    The **Catalog Server**, **Intranet parameters** and **Proxy server** settings below (host/port/protocol/log level, the intranet network/netmask, and the outbound proxy configuration) can only be *edited* by a user with the [Superadministrator profile](../managing-users-and-groups/index.md#user_profiles). A regular `Administrator` can still view these settings — they are shown, not hidden — but the form fields are disabled, with a lock icon and tooltip explaining why. Attempting to change one of these settings directly through the API without the Superadministrator profile is rejected outright (`403 Forbidden`), and no part of that request is saved, including any other, unrelated settings submitted in the same request.
+
 
 ![](img/settings.png)
 
@@ -25,6 +29,9 @@ Since the settings form is a long form, the `save` button is repeated between th
 
 ## Catalog Server {#system-config-server}
 
+!!! note
+    These settings can only be edited by a Superadministrator. See [Superadministrator-only settings](#system-configuration) above.
+
 -   **Host** The node's name or IP number (without `http://`). For example, they are used during metadata editing to create resource links and when returning the server's capabilities during a CSW request.
     -   If your node is publicly accessible from the Internet, you have to use the domain name.
     -   If your node is hidden inside your private network and you have a firewall or web server that redirects incoming requests to the node, you have to enter the public address of the firewall or web server. A typical configuration is to have an Apache web server on address A that is publicly accessible and redirects the requests to a Tomcat server on a private address B. In this case you have to enter A in the host parameter.
@@ -36,6 +43,9 @@ Since the settings form is a long form, the `save` button is repeated between th
 
 ## Intranet parameters
 
+!!! note
+    These settings can only be edited by a Superadministrator. See [Superadministrator-only settings](#system-configuration) above.
+
 A common need for an organisation is to automatically discriminate between anonymous internal users that access the node from within an organisation (Intranet) and anonymous external users from the Internet. The catalog defines anonymous users from inside the organisation as belonging to the group *Intranet*, while anonymous users from outside the organisation are defined by the group *All*. To automatically distinguish users that belong to the Intranet group you need to tell the catalog the intranet IP address and netmask.
 
 -   **Network** The intranet address in IP form (eg. 147.109.100.0). It can be a comma separated list of IP addresses.
@@ -45,6 +55,9 @@ If intranet parameters are empty, the group *Intranet* will not be displayed in
 
 ## Proxy server
 
+!!! note
+    These settings can only be edited by a Superadministrator. See [Superadministrator-only settings](#system-configuration) above.
+
 The settings page offers to set the configuration of a proxy server. This configuration is used by the application to access the internet to get online resources, for example as part of a harvest process.
 
 -   **Use proxy** Enable the proxy in case the catalog is behind a proxy and need to use it to access remote resources.

docs/manual/docs/administrator-guide/managing-users-and-groups/index.md

@@ -32,7 +32,7 @@ The catalog uses the concept of Users, Groups and User Profiles.
 
 -   A User can be part of one or more Groups.
 -   A User has a Role in a Group.
--   The Administrator Role is not related to a Group.
+-   The Administrator and Superadministrator Roles are not related to a Group.
 
 The combination of Role and Group defines what tasks the User can perform on the system or on specific metadata records.
 
@@ -42,7 +42,14 @@ Roles are hierarchical and based on inheritance. This means that a user with an
 
 Rights associated with the roles are illustrated in detail in the list below:
 
-1.  **Administrator Profile**
+1.  **Superadministrator Profile**
+
+    The Superadministrator has every privilege of the Administrator Profile described below, plus exclusive rights over a small set of server-level settings:
+
+    -   Everything the Administrator Profile can do (see below) - all Administrator privileges are inherited.
+    -   Exclusive right to *edit* the **Catalog Server**, **Intranet parameters** and **Proxy server** settings (see [System configuration](../configuring-the-catalog/system-configuration.md)). An Administrator can still view these settings but cannot change them.
+
+2.  **Administrator Profile**
 
     The Administrator has special privileges that give access to all available functions.
 
@@ -53,26 +60,26 @@ Rights associated with the roles are illustrated in detail in the list below:
     -   Full rights for creating/editing/deleting new/old metadata.
     -   Perform system administration and configuration tasks.
 
-2.  **User Administrator Profile**
+3.  **User Administrator Profile**
 
     The user administrator is the administrator of their own group(s) with the following privileges:
 
     -   Full rights on creating new users within their own groups.
     -   Rights to change users profiles within their own groups.
 
-3.  **Content Reviewer Profile**
+4.  **Content Reviewer Profile**
 
     The content reviewer is the only person allowed to give final clearance on the metadata publication on the intranet and/or on the internet:
 
     -   Rights on reviewing metadata content within their own groups and authorising its approval and publication.
 
-4.  **Editor Profile**
+5.  **Editor Profile**
 
     The editor works on metadata with the following privileges:
 
     -   Full rights on creating/editing/deleting new/old data within their own groups.
 
-5.  **Registered User Profile**
+6.  **Registered User Profile**
 
     The Registered User has more access privileges than non-authenticated Guest users:
 
@@ -82,6 +89,9 @@ Rights associated with the roles are illustrated in detail in the list below:
 
 The tables below show a comprehensive overview of Roles and Features. It explains in detail what each role can do in GeoNetwork.
 
+!!! note
+    The tables below do not include a separate Superadministrator column. Superadministrator is a strict superset of the Administrator profile for every feature shown here: anywhere a table shows :material-check-circle: (or any other mark) for Administrator, a Superadministrator has the same access. The only difference between the two profiles is the exclusive right to edit the settings described under [Superadministrator Profile](#user_profiles) above, which are not part of these feature tables.
+
 | Code | Description                                                   |
 |------|---------------------------------------------------------------|
 | UI   | Feature visible in the UI, but not usable by the user profile |