Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/database/migrations/sqlite/001_core.sql

@@ -12,7 +12,6 @@ CREATE TABLE IF NOT EXISTS users (
     password_hash   TEXT,
     display_name    TEXT,
     avatar_url      TEXT,
-    role            TEXT DEFAULT 'user' CHECK (role IN ('user', 'admin')),
     is_active       INTEGER DEFAULT 1,
     settings        TEXT DEFAULT '{}',
     auth_source     TEXT NOT NULL DEFAULT 'builtin',

server/database/migrations/sqlite/002_teams.sql

@@ -40,9 +40,6 @@ CREATE TABLE IF NOT EXISTS groups (
     created_by  TEXT REFERENCES users(id),
     source      TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('manual', 'oidc', 'system')),
     permissions          TEXT NOT NULL DEFAULT '[]',
-    token_budget_daily   INTEGER,
-    token_budget_monthly INTEGER,
-    allowed_models       TEXT,
     created_at  TEXT DEFAULT (datetime('now')),
     updated_at  TEXT DEFAULT (datetime('now'))
 );
@@ -74,3 +71,15 @@ VALUES (
     'global', NULL, 'system',
     '["extension.use","workflow.submit"]'
 );
+
+-- Seed Admins group — members receive full platform permissions.
+-- Replaces the legacy users.role = 'admin' authorization check.
+-- Membership is managed by bootstrap/seed logic at runtime.
+INSERT OR IGNORE INTO groups (id, name, description, scope, created_by, source, permissions)
+VALUES (
+    '00000000-0000-0000-0000-000000000002',
+    'Admins',
+    'Full platform access — replaces legacy admin role.',
+    'global', NULL, 'system',
+    '["surface.admin.access","extension.use","extension.install","workflow.create","workflow.submit","admin.view","token.unlimited"]'
+);