drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/mtls_test.go

@@ -96,24 +96,17 @@ func TestMTLSConfig_Defaults(t *testing.T) {
 	if p.cfg.HeaderFingerprint != "X-SSL-Client-Fingerprint" {
 		t.Errorf("HeaderFingerprint = %q, want X-SSL-Client-Fingerprint", p.cfg.HeaderFingerprint)
 	}
-	if p.cfg.DefaultRole != "user" {
-		t.Errorf("DefaultRole = %q, want user", p.cfg.DefaultRole)
-	}
 }
 
 func TestMTLSConfig_Custom(t *testing.T) {
 	p := NewMTLSProvider(MTLSConfig{
 		HeaderDN:     "X-Client-Cert-DN",
 		HeaderVerify: "X-Client-Cert-Verify",
-		DefaultRole:  "admin",
 	})
 
 	if p.cfg.HeaderDN != "X-Client-Cert-DN" {
 		t.Errorf("HeaderDN = %q, want X-Client-Cert-DN", p.cfg.HeaderDN)
 	}
-	if p.cfg.DefaultRole != "admin" {
-		t.Errorf("DefaultRole = %q, want admin", p.cfg.DefaultRole)
-	}
 }
 
 func TestMTLSProvider_Mode(t *testing.T) {