drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/builtin.go

@@ -82,7 +82,6 @@ func (p *BuiltinProvider) Register(c *gin.Context, stores store.Stores) (*Result
 		Username:     strings.ToLower(req.Username),
 		Email:        strings.ToLower(req.Email),
 		PasswordHash: string(hash),
-		Role:         models.UserRoleUser,
 		IsActive:     defaultActive,
 		AuthSource:   string(ModeBuiltin),
 		Handle:       handle,
@@ -92,6 +91,8 @@ func (p *BuiltinProvider) Register(c *gin.Context, stores store.Stores) (*Result
 		return nil, err
 	}
 
+	EnsureEveryoneGroup(ctx, stores, user.ID)
+
 	return &Result{User: user, IsNewUser: true, VaultHint: req.Password}, nil
 }