Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/database/migrations/postgres/001_core.sql

@@ -23,8 +23,6 @@ CREATE TABLE IF NOT EXISTS users (
     password_hash   TEXT,
     display_name    VARCHAR(100),
     avatar_url      TEXT,
-    role            VARCHAR(20) DEFAULT 'user'
-                    CHECK (role IN ('user', 'admin')),
     is_active       BOOLEAN DEFAULT true,
     settings        JSONB DEFAULT '{}'::jsonb,
     auth_source     VARCHAR(20) NOT NULL DEFAULT 'builtin'

server/database/migrations/postgres/002_teams.sql

@@ -44,9 +44,6 @@ CREATE TABLE IF NOT EXISTS groups (
     source      VARCHAR(20) NOT NULL DEFAULT 'manual'
                 CHECK (source IN ('manual', 'oidc', 'system')),
     permissions          JSONB   NOT NULL DEFAULT '[]'::jsonb,
-    token_budget_daily   BIGINT,
-    token_budget_monthly BIGINT,
-    allowed_models       JSONB,
     created_at  TIMESTAMPTZ DEFAULT NOW(),
     updated_at  TIMESTAMPTZ DEFAULT NOW(),
     CONSTRAINT groups_scope_team CHECK (
@@ -83,3 +80,16 @@ VALUES (
     '["extension.use","workflow.submit"]'::jsonb
 )
 ON CONFLICT (id) DO NOTHING;
+
+-- Seed Admins group — members receive full platform permissions.
+-- Replaces the legacy users.role = 'admin' authorization check.
+-- Membership is managed by bootstrap/seed logic at runtime.
+INSERT INTO groups (id, name, description, scope, created_by, source, permissions)
+VALUES (
+    '00000000-0000-0000-0000-000000000002',
+    'Admins',
+    'Full platform access — replaces legacy admin role.',
+    'global', NULL, 'system',
+    '["surface.admin.access","extension.use","extension.install","workflow.create","workflow.submit","admin.view","token.unlimited"]'::jsonb
+)
+ON CONFLICT (id) DO NOTHING;