admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/database/migrations/postgres/002_teams.sql

@@ -83,3 +83,16 @@ VALUES (
     '["extension.use","workflow.submit"]'::jsonb
 )
 ON CONFLICT (id) DO NOTHING;
+
+-- Seed Admins group — members receive full platform permissions.
+-- Replaces the legacy users.role = 'admin' authorization check.
+-- Membership is managed by bootstrap/seed logic at runtime.
+INSERT INTO groups (id, name, description, scope, created_by, source, permissions)
+VALUES (
+    '00000000-0000-0000-0000-000000000002',
+    'Admins',
+    'Full platform access — replaces legacy admin role.',
+    'global', NULL, 'system',
+    '["surface.admin.access","extension.use","extension.install","workflow.create","workflow.submit","admin.view","token.unlimited"]'::jsonb
+)
+ON CONFLICT (id) DO NOTHING;