admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -513,7 +513,7 @@ func main() {
 		// ── Admin routes ────────────────────────
 		admin := api.Group("/admin")
 		admin.Use(middleware.Auth(cfg, stores.Users, userCache))
-		admin.Use(middleware.RequireAdmin())
+		admin.Use(middleware.RequireAdmin(stores))
 		admin.Use(middleware.ValidatePathParams())
 		{
 			adm := handlers.NewAdminHandler(stores, keyResolver, uekCache, objStore)
@@ -693,7 +693,7 @@ func main() {
 		Authenticated: middleware.AuthOrRedirect(cfg, stores.Users, userCache),
 		Admin: []gin.HandlerFunc{
 			middleware.AuthOrRedirect(cfg, stores.Users, userCache),
-			middleware.RequireAdminPage(),
+			middleware.RequireAdminPage(stores),
 		},
 		Session: middleware.AuthOrRedirect(cfg, stores.Users, userCache), // TODO: session middleware for workflow visitors (v0.2.0)
 	})