Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

CHANGELOG.md

@@ -2,7 +2,62 @@
 
 All notable changes to Switchboard Core are documented here.
 
-## [Unreleased] — v0.1.0
+## [Unreleased] — v0.2.0
+
+### Added
+
+- **Full RBAC**: all authorization flows through group membership and permission
+  grants. No magic roles, no implicit group membership, no special-casing.
+- `surface.admin.access` permission — any group can grant admin panel access
+- Admins system group seeded with all platform permissions
+- Everyone system group — all users explicitly added on creation
+- `EnsureEveryoneGroup()`, `AddToAdminsGroup()`, `RemoveFromAdminsGroup()` helpers
+- `SeedAdminsGroupMember()`, `SeedEveryoneGroupMember()` test helpers
+- System groups re-seeded after `TruncateAll` in test helper
+- OIDC `isIdPAdmin()` — maps IdP role claims to Admins group membership
+
+### Changed
+
+- `RequireAdmin()` / `RequireAdminPage()` check `surface.admin.access` grant
+- `RequirePermission()` no longer bypasses for admin role
+- `ResolvePermissions()` unions explicit group memberships only (no implicit Everyone)
+- All user creation paths (builtin, OIDC, mTLS, admin, bootstrap, seed) add to
+  Everyone group. Admin users added to Admins group.
+- JWT claims no longer include `role` field
+- Login response no longer includes `role` in user object
+- Profile endpoint no longer returns `role`
+- Profile bootstrap resolves permissions from groups (no admin shortcut)
+- Middleware auth cache tracks `isActive` only (no role)
+- Admin create user accepts `is_admin` bool (not role string)
+- Admin update role endpoint accepts `is_admin` bool, manages Admins group directly
+- Demotion/deletion safeguards check Admins group member count
+- Notifications `RoleFallbackHandler` queries Admins group members
+- OIDC syncs Admins group on login (no role column writes)
+- Kernel permissions: 6 → 7 (added `surface.admin.access`)
+- Admin users UI: role dropdown removed, admin managed through groups
+
+### Removed
+
+- **`users.role` column** — dropped from schema, model, JWT, all handlers
+- `UserRoleAdmin`, `UserRoleUser` constants
+- `CountByRole()` store method
+- `DefaultRole` config for OIDC and mTLS providers
+- `SyncAdminsGroupMembership()` (replaced by `AddToAdminsGroup`/`RemoveFromAdminsGroup`)
+- OIDC `resolveRole()` (replaced by `isIdPAdmin()`)
+- **Token budgets** from groups: columns, `ResolveTokenBudget()`, all store/handler/UI
+- **Allowed models** from groups: column, `ResolveModelAllowlist()`, UI
+- Admin groups UI: Token Budgets section, Allowed Models section
+
+### Migration notes
+
+- 001_core.sql (both dialects): removed `role` column from users table
+- 002_teams.sql (both dialects): added Admins group seed, removed
+  `token_budget_daily`, `token_budget_monthly`, `allowed_models` columns
+- No new migration files — edited in place per pre-MVP policy
+
+---
+
+## [v0.1.0] — 2026-03-26
 
 Forked from chat-switchboard v0.38.5. Gutted to a pure extension platform.