Improvement
1- Dual lock applied: migration default_roles restriction combined with frontend allowedRoles guard prevents permission leakage
Bug Fixes
2- Support sidebar group (documentation, forum, changelog, updates) is now restricted to ROOT role by default in migration 000189
- New migration 000405 tightens support.changelog default_roles to ROOT on existing installations without touching operator-set role_page_permissions overrides