case 4719 - report templates changed only by Business administration

Business administration - restricted could create, edit and import report
templates, although the roles page uses exactly this as its example of a
view-only restricted role. A template's script runs with the rights of
whoever renders it (SuperUser for customer notifications), so changing one
is an administrator right (F20). Report templates page and changelog
updated. Deferred: audit every documented role right against BizRoles.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/biz/BizRoles.cs

@@ -873,7 +873,9 @@ namespace AyaNova.Biz
             //            
             roles.Add(AyaType.Report, new BizRoleSet()
             {
-                Change = AuthorizationRoles.BizAdmin | AuthorizationRoles.BizAdminRestricted,
+                //case 4719: BizAdminRestricted only views templates, as ay-biz-admin-roles.md describes (a template's script runs
+                //with the rights of whoever renders it, so changing one is an administrator right)
+                Change = AuthorizationRoles.BizAdmin,
                 ReadFullRecord = AuthorizationRoles.All,
                 Select = AuthorizationRoles.All
             });