Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

ROADMAP.md

@@ -36,11 +36,17 @@ platform that extensions build on.
 The contract that extensions build against. Three trigger primitives,
 SDK stabilization, and the first rebuilt extension (tasks).
 
-- **Trigger system**: time (cron), webhook (inbound HTTP), event (bus subscription)
+| Step | Status | Description |
+|------|--------|-------------|
+| Admin → RBAC group | ✅ | `surface.admin.access` permission + Admins system group replaces `role == "admin"` checks. Admin bypass removed from permission middleware. |
+| Settings cascade | 🔲 | `user_overridable` flag, RBAC scope auth, resolution chain |
+| ICD (API contract) | 🔲 | OpenAPI spec from registered routes, kernel-only endpoint docs |
+| Trigger system | 🔲 | Time (cron), webhook (inbound HTTP), event (bus subscription) |
+| SDK stabilization | 🔲 | `sb.slots()`, `sb.actions`, `sb.api.ext()`, `sb.storage`, theme tokens, primitive UI |
+
+### Remaining v0.2.0 features
+
 - **Event bus subscriptions**: extensions register match expressions at install time
-- **SDK contract**: `sb.slots()`, `sb.actions`, `sb.api.ext()`, `sb.storage`
-- **Primitive UI components**: toast, confirm, prompt, dialog (stabilize existing)
-- **Theme tokens** exposed to extensions
 - **Task extension**: first proof-of-concept — full task system rebuilt as a
   Starlark extension using triggers + ext_data + notifications
 - **Settings override model**: RBAC controls scope auth (admin → global,