admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/permissions.go

@@ -8,23 +8,30 @@ import (
 )
 
 // EveryoneGroupID is the stable ID of the implicit "Everyone" group seeded in
-// migration 020. Every authenticated user receives its permissions without an
+// migration 002. Every authenticated user receives its permissions without an
 // explicit membership row.
 const EveryoneGroupID = "00000000-0000-0000-0000-000000000001"
 
+// AdminsGroupID is the stable ID of the "Admins" system group seeded in
+// migration 002. Members receive surface.admin.access and all platform
+// permissions. Replaces the legacy users.role = 'admin' check.
+const AdminsGroupID = "00000000-0000-0000-0000-000000000002"
+
 // Permission constants — domain.action convention.
 const (
-	PermExtensionUse     = "extension.use"     // use installed extensions
-	PermExtensionInstall = "extension.install"  // install/manage extension packages
-	PermWorkflowCreate   = "workflow.create"    // create workflow definitions
-	PermWorkflowSubmit   = "workflow.submit"    // submit to public workflows
-	PermAdminView        = "admin.view"         // read-only admin panel access
-	PermTokenUnlimited   = "token.unlimited"    // bypass token budgets
+	PermSurfaceAdminAccess = "surface.admin.access" // full admin panel access (replaces role check)
+	PermExtensionUse       = "extension.use"        // use installed extensions
+	PermExtensionInstall   = "extension.install"     // install/manage extension packages
+	PermWorkflowCreate     = "workflow.create"       // create workflow definitions
+	PermWorkflowSubmit     = "workflow.submit"       // submit to public workflows
+	PermAdminView          = "admin.view"            // read-only admin panel access
+	PermTokenUnlimited     = "token.unlimited"       // bypass token budgets
 )
 
 // AllPermissions is the complete set of valid permission strings.
 // Used for validation in handlers and rendering checkboxes in admin UI.
 var AllPermissions = []string{
+	PermSurfaceAdminAccess,
 	PermExtensionUse,
 	PermExtensionInstall,
 	PermWorkflowCreate,
@@ -37,7 +44,7 @@ var AllPermissions = []string{
 
 // ResolvePermissions returns the effective permission set for a user.
 // Always includes the Everyone group regardless of membership.
-// Callers should short-circuit for role=admin before calling this.
+// Includes both implicit Everyone group and explicit group memberships.
 func ResolvePermissions(ctx context.Context, stores store.Stores, userID string) (map[string]bool, error) {
 	perms := make(map[string]bool)
 
@@ -62,6 +69,17 @@ func ResolvePermissions(ctx context.Context, stores store.Stores, userID string)
 	return perms, nil
 }
 
+// SyncAdminsGroupMembership adds or removes a user from the Admins group
+// based on their role. Called by auth providers and admin handlers when
+// a user's role changes so that permissions stay in sync.
+func SyncAdminsGroupMembership(ctx context.Context, stores store.Stores, userID, role string) {
+	if role == "admin" {
+		_ = stores.Groups.AddMember(ctx, AdminsGroupID, userID, userID)
+	} else {
+		_ = stores.Groups.RemoveMember(ctx, AdminsGroupID, userID)
+	}
+}
+
 // ── Token Budget ────────────────────────────
 
 // TokenBudget holds the resolved ceiling for a user and the time window it covers.