How to Handle User Permissions Across a System

There is no single proper approach to your problems even within MVC pattern so simple answer to your questions does not exist.

1 Error handling

If you are using the PDO you can change error handling by setting PDO::ATTR_ERRMODE so you don't have to use exceptions but regardless of the way errors are returned it is a programmers responsibility to handle them properly. If your method is returning false if the user doesn't exists then the controller should check what value was returned. There is no such thing as "controller assumes" it only means that the programmer assumed and didn't check returned value.

There are different errors which should be handled in different way some of them may require only showing error message some of them may be critical (like no db connection). You can use messages, views or additional controller to handle errors.

2 The proper way to show a view

Code from your example would be usually handled by the layout (header, footer, different element placement) and by the controller (using different views depending on the request). It is not good idea to use 'include' directly rather wrap it in the method. You can also create view class which would be responsible for handling views. view != .phtml

3 Managing user rights

In MVC pattern used for web applications there is usually additional "front controller" and permission checking will be handled there. You have to check for permission with each request and each request will require access to specific controller/method if you implement proper ACL it should resolve all your problems with user rights.

I am not a liquibase expert, but a short look into the docs revealed it has a feature called "SQL output", which makes it possible to generate scripts for updating the DB. Those scripts can be handed over to a DBA with the required permissions.

So if you want permission changes to be applied only by a root user (but schema changes still be applied by your "liquibase user"), you simply have to make sure you can separate them from the changesets which are allowed for your "liquibase user". I guess you can utilize the context feature of Liquibase for this. Define a "root" context for this purpose and tag your permission changesets with that context. Then let Liquibase produce sql output specificially for this context (see the command line options how to do this), and pass the result over to a dba with the required root permissions.

That way, it should allow you to keep permission changes in source control under the same liquibase project as schema changes without any need for granting the liquibase user additional permissions.