admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/oidc.go

@@ -171,6 +171,9 @@ func (p *OIDCProvider) Authenticate(c *gin.Context, stores store.Stores) (*Resul
 			user.Role = role
 		}
 
+		// Sync Admins group membership with resolved role
+		SyncAdminsGroupMembership(ctx, stores, user.ID, role)
+
 		// Sync groups
 		p.syncGroups(ctx, user.ID, claims, stores)
 
@@ -474,6 +477,9 @@ func (p *OIDCProvider) autoProvision(
 
 	log.Printf("[auth/oidc] auto-provisioned user %s (sub=%s, email=%s)", user.ID, sub, email)
 
+	// Sync Admins group membership with resolved role
+	SyncAdminsGroupMembership(ctx, stores, user.ID, role)
+
 	// Auto-add to default team
 	if p.cfg.DefaultTeam != "" {
 		if err := stores.Teams.AddMember(ctx, p.cfg.DefaultTeam, user.ID, "member"); err != nil {