Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/auth/mtls.go

@@ -19,7 +19,6 @@ type MTLSConfig struct {
 	HeaderFingerprint string // header carrying cert fingerprint (default "X-SSL-Client-Fingerprint")
 	AutoActivate      bool   // auto-activate new users (default true)
 	DefaultTeam       string // team ID for auto-provisioned users (optional)
-	DefaultRole       string // "user" (default) or "admin"
 }
 
 // MTLSProvider authenticates via client certificate headers injected
@@ -48,9 +47,6 @@ func NewMTLSProvider(cfg MTLSConfig) *MTLSProvider {
 	if cfg.HeaderFingerprint == "" {
 		cfg.HeaderFingerprint = "X-SSL-Client-Fingerprint"
 	}
-	if cfg.DefaultRole == "" {
-		cfg.DefaultRole = models.UserRoleUser
-	}
 	return &MTLSProvider{cfg: cfg}
 }
 
@@ -134,7 +130,6 @@ func (p *MTLSProvider) autoProvision(
 		Username:    handle,
 		Email:       email,
 		DisplayName: cn,
-		Role:        p.cfg.DefaultRole,
 		IsActive:    true,
 		AuthSource:  string(ModeMTLS),
 		ExternalID:  &fingerprint,
@@ -146,6 +141,7 @@ func (p *MTLSProvider) autoProvision(
 	}
 
 	log.Printf("[auth/mtls] auto-provisioned user %s from CN=%s", user.ID, cn)
+	EnsureEveryoneGroup(ctx, stores, user.ID)
 
 	// Auto-add to default team if configured
 	if p.cfg.DefaultTeam != "" {