Can an apex code, invoked by a non-admin user, perform an update on a field that has a field-level security of
read-only for non-admin profiles?
If so, what is permitted/restricted by the above field-level security?
The edit access to the record is determined by the sharing access granted to the user, unless you declare the apex class as without sharing.
Apex executes in system mode so it would override FLS and be able to write to the field.
The FLS Read Only will apply to a user having the said Profile editing the record via the UI http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS
Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution.
For more detail you can visit this link