Feat v0.2.3 sdk tasks (#7)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/auth/permissions.go

@@ -2,7 +2,10 @@ package auth
 
 import (
 	"context"
+	"encoding/json"
+	"log"
 
+	"switchboard-core/database"
 	"switchboard-core/store"
 )
 
@@ -65,8 +68,42 @@ func EnsureEveryoneGroup(ctx context.Context, stores store.Stores, userID string
 	_ = stores.Groups.AddMember(ctx, EveryoneGroupID, userID, userID)
 }
 
+// EnsureAdminsGroup creates the Admins system group if it does not exist.
+// Handles the case where migration 002 was applied before the Admins INSERT
+// was added (no new migrations pre-MVP — edits in place).
+// Uses raw SQL because the store's Create() overwrites the ID.
+func EnsureAdminsGroup(ctx context.Context, stores store.Stores) {
+	if _, err := stores.Groups.GetByID(ctx, AdminsGroupID); err == nil {
+		return // already exists
+	}
+	permsJSON, _ := json.Marshal(AllPermissions)
+	db := database.DB
+	if db == nil {
+		return
+	}
+	_, err := db.ExecContext(ctx, `
+		INSERT OR IGNORE INTO groups (id, name, description, scope, created_by, source, permissions)
+		VALUES (?, 'Admins', 'Full platform access — replaces legacy admin role.',
+		        'global', NULL, 'system', ?)`,
+		AdminsGroupID, string(permsJSON))
+	if err != nil {
+		// Postgres variant
+		_, err = db.ExecContext(ctx, `
+			INSERT INTO groups (id, name, description, scope, created_by, source, permissions)
+			VALUES ($1, 'Admins', 'Full platform access — replaces legacy admin role.',
+			        'global', NULL, 'system', $2::jsonb)
+			ON CONFLICT (id) DO NOTHING`,
+			AdminsGroupID, string(permsJSON))
+		if err != nil {
+			log.Printf("⚠ EnsureAdminsGroup: %v", err)
+		}
+	}
+}
+
 // AddToAdminsGroup adds a user to the Admins group (idempotent).
+// Ensures the Admins group exists before attempting membership.
 func AddToAdminsGroup(ctx context.Context, stores store.Stores, userID string) {
+	EnsureAdminsGroup(ctx, stores)
 	_ = stores.Groups.AddMember(ctx, AdminsGroupID, userID, userID)
 }