Update all guides (NL + EN) for CodePress 2.5.2 features

- Admin guide: RBAC roles, role-based dashboard, plugin types (content/system)
- CodePress developer guide: plugin types, admin plugin API, SCSS compilation, asset serving
- Theme developer guide: SCSS sole CSS source, css_compiled read-only, guide layout
- Content manager guide: layout selection from theme.json, plugin order in frontmatter
- Both NL and EN updated with identical structure
- 35 files updated

guide/en/admin-beheerder/gebruikers.md

@@ -1,13 +1,40 @@
 # Users
 
-## Add user
+Users are stored in `admin/config/admin.json` (file-based, no database). Each user has a **role** that determines which admin routes and sidebar items are visible.
+
+## Roles
+
+CodePress has four roles, defined in `AdminAuth::ROLE_PERMISSIONS`:
+
+| Role | Label | Permissions |
+|------|-------|-------------|
+| `admin` | Admin | Everything (`*`) |
+| `content-manager` | Content Manager | Content management, guide |
+| `bi-manager` | BI Manager | Statistics, logs, guide |
+| `site-admin` | Site Admin | Theme, plugins, statistics, logs, update, guide |
+
+Roles are displayed with their label via `AdminAuth::ROLE_LABELS`.
+
+## Adding a user
 
 1. Go to **Users**
 2. Enter username
-3. Choose password
-4. Click **Add**
+3. Choose password (stored as bcrypt hash)
+4. Select a role
+5. Click **Add**
 
-## Delete user
+## Editing a user
 
-- Cannot delete own account
-- Confirm with password
+- Change password (new bcrypt hash)
+- Change role (immediately affects visible routes and sidebar items)
+
+## Deleting a user
+
+- Not possible for own account
+- Confirm with password
+
+## Access control
+
+- Route access is checked in `public/admin.php` via `AdminAuth::hasPermission()`
+- Unauthorized routes return a **403 error**
+- Sidebar items are conditionally shown via the `has_permission()` Twig function in `admin.twig`