drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/mtls.go

@@ -19,7 +19,6 @@ type MTLSConfig struct {
 	HeaderFingerprint string // header carrying cert fingerprint (default "X-SSL-Client-Fingerprint")
 	AutoActivate      bool   // auto-activate new users (default true)
 	DefaultTeam       string // team ID for auto-provisioned users (optional)
-	DefaultRole       string // "user" (default) or "admin"
 }
 
 // MTLSProvider authenticates via client certificate headers injected
@@ -48,9 +47,6 @@ func NewMTLSProvider(cfg MTLSConfig) *MTLSProvider {
 	if cfg.HeaderFingerprint == "" {
 		cfg.HeaderFingerprint = "X-SSL-Client-Fingerprint"
 	}
-	if cfg.DefaultRole == "" {
-		cfg.DefaultRole = models.UserRoleUser
-	}
 	return &MTLSProvider{cfg: cfg}
 }
 
@@ -134,7 +130,6 @@ func (p *MTLSProvider) autoProvision(
 		Username:    handle,
 		Email:       email,
 		DisplayName: cn,
-		Role:        p.cfg.DefaultRole,
 		IsActive:    true,
 		AuthSource:  string(ModeMTLS),
 		ExternalID:  &fingerprint,
@@ -146,6 +141,7 @@ func (p *MTLSProvider) autoProvision(
 	}
 
 	log.Printf("[auth/mtls] auto-provisioned user %s from CN=%s", user.ID, cn)
+	EnsureEveryoneGroup(ctx, stores, user.ID)
 
 	// Auto-add to default team if configured
 	if p.cfg.DefaultTeam != "" {