What about a static site generator? Plaintext, markdown, but renders to html with headings and whatnot. Version control is because it’s in git.

Read access control is difficult though. You could do some hacks like using encrypting files in the git repo (perhaps with SOPS), and then either using http basic auth to control access to specific pages or something like staticrypt. But these are not ideal solutions.