admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/notification_test.go

@@ -65,7 +65,7 @@ func setupNotifHarness(t *testing.T) *notifHarness {
 	// Admin broadcast route (v0.28.6)
 	admin := api.Group("/admin")
 	admin.Use(middleware.Auth(cfg, stores.Users, userCache))
-	admin.Use(middleware.RequireAdmin())
+	admin.Use(middleware.RequireAdmin(stores))
 	admin.POST("/notifications/broadcast", notifH.Broadcast)
 
 	// Set up notification service singleton for Broadcast handler
@@ -75,6 +75,7 @@ func setupNotifHarness(t *testing.T) *notifHarness {
 	// Seed admin
 	adminID := database.SeedTestUser(t, "notif-admin", "notif-admin@test.com")
 	database.TestDB.Exec(dialectSQL("UPDATE users SET role = 'admin', is_active = true WHERE id = $1"), adminID)
+	database.SeedAdminsGroupMember(t, adminID)
 	adminToken := makeToken(adminID, "notif-admin@test.com", "admin")
 
 	// Seed regular user