admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,7 +2,39 @@
 
 All notable changes to Switchboard Core are documented here.
 
-## [Unreleased] — v0.1.0
+## [Unreleased] — v0.2.0
+
+### Added
+
+- **Admin → RBAC group migration**: `surface.admin.access` permission replaces
+  hardcoded `role == "admin"` checks. Seeded "Admins" system group carries all
+  platform permissions. Admin middleware now resolves grants through the standard
+  permission system — no special-casing. Any group can grant `surface.admin.access`.
+- `AdminsGroupID` constant (`00000000-0000-0000-0000-000000000002`)
+- `SyncAdminsGroupMembership()` — shared helper used by bootstrap, seed, OIDC,
+  and admin handlers to keep group membership in sync with role changes
+- `SeedAdminsGroupMember()` test helper
+- System groups re-seeded after `TruncateAll` in test helper
+
+### Changed
+
+- `RequireAdmin()` / `RequireAdminPage()` now accept `store.Stores` and check
+  `surface.admin.access` grant instead of `role == "admin"`
+- `RequirePermission()` no longer bypasses checks for admin role — admins get
+  permissions through group membership like everyone else
+- Bootstrap/seed/OIDC login all add admin users to Admins group
+- Admin create/update/delete handlers sync Admins group membership on role change
+- Demotion/deletion safeguards count Admins group members instead of `CountByRole`
+- Kernel permissions: 6 → 7 (added `surface.admin.access`)
+
+### Migration notes
+
+- 002_teams.sql (both dialects): added Admins group seed with all permissions
+- No new migration files — edited in place per pre-MVP policy
+
+---
+
+## [v0.1.0] — 2026-03-26
 
 Forked from chat-switchboard v0.38.5. Gutted to a pure extension platform.