admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/middleware/admin.go

@@ -4,14 +4,19 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+
+	"switchboard-core/auth"
+	"switchboard-core/store"
 )
 
-// RequireAdmin returns middleware that restricts access to admin users.
-// Must be used after Auth() middleware which sets "role" in context.
-func RequireAdmin() gin.HandlerFunc {
+// RequireAdmin returns middleware that restricts access to users with the
+// surface.admin.access permission (i.e. members of the Admins group).
+// Must be used after Auth() middleware which sets "user_id" in context.
+func RequireAdmin(stores store.Stores) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		role, exists := c.Get("role")
-		if !exists || role != "admin" {
+		userID := c.GetString("user_id")
+		perms, err := resolveAndCachePerms(c, stores, userID)
+		if err != nil || !perms[auth.PermSurfaceAdminAccess] {
 			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
 				"error": "admin access required",
 			})

server/middleware/page_auth.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"switchboard-core/auth"
 	"switchboard-core/config"
 	"switchboard-core/database"
 	"switchboard-core/store"
@@ -85,12 +86,13 @@ func AuthOrRedirect(cfg *config.Config, users store.UserStore, cache *UserStatus
 	}
 }
 
-// RequireAdminPage aborts with 403 if the user isn't an admin.
+// RequireAdminPage aborts with 403 if the user lacks surface.admin.access.
 // Use after AuthOrRedirect for admin-only page routes.
-func RequireAdminPage() gin.HandlerFunc {
+func RequireAdminPage(stores store.Stores) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		role, _ := c.Get("role")
-		if role != "admin" {
+		userID := c.GetString("user_id")
+		perms, err := resolveAndCachePerms(c, stores, userID)
+		if err != nil || !perms[auth.PermSurfaceAdminAccess] {
 			c.String(http.StatusForbidden, "Admin access required")
 			c.Abort()
 			return

server/middleware/permissions.go

@@ -12,17 +12,11 @@ import (
 const permCacheKey = "resolved_permissions"
 
 // RequirePermission returns middleware that enforces a named permission.
-// Admin users bypass the check entirely. Permission resolution is cached in
-// the request context — computed at most once per request regardless of how
-// many RequirePermission middlewares are chained.
+// Permission resolution is cached in the request context — computed at most
+// once per request regardless of how many RequirePermission middlewares are
+// chained. Admins receive permissions through the Admins group.
 func RequirePermission(perm string, stores store.Stores) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		role, _ := c.Get("role")
-		if role == "admin" {
-			c.Next()
-			return
-		}
-
 		userID := c.GetString("user_id")
 		perms, err := resolveAndCachePerms(c, stores, userID)
 		if err != nil || !perms[perm] {