admin → RBAC group migration: grant-based access replaces role check

surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/middleware/permissions.go

@@ -12,17 +12,11 @@ import (
 const permCacheKey = "resolved_permissions"
 
 // RequirePermission returns middleware that enforces a named permission.
-// Admin users bypass the check entirely. Permission resolution is cached in
-// the request context — computed at most once per request regardless of how
-// many RequirePermission middlewares are chained.
+// Permission resolution is cached in the request context — computed at most
+// once per request regardless of how many RequirePermission middlewares are
+// chained. Admins receive permissions through the Admins group.
 func RequirePermission(perm string, stores store.Stores) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		role, _ := c.Get("role")
-		if role == "admin" {
-			c.Next()
-			return
-		}
-
 		userID := c.GetString("user_id")
 		perms, err := resolveAndCachePerms(c, stores, userID)
 		if err != nil || !perms[perm] {