drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/auth_test.go

@@ -40,7 +40,6 @@ func TestJWTGeneration(t *testing.T) {
 	claims := Claims{
 		UserID: "550e8400-e29b-41d4-a716-446655440000",
 		Email:  "test@example.com",
-		Role:   "user",
 		RegisteredClaims: jwt.RegisteredClaims{
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(15 * time.Minute)),
@@ -75,9 +74,6 @@ func TestJWTGeneration(t *testing.T) {
 	if parsed.Email != claims.Email {
 		t.Errorf("Email mismatch: got %s, want %s", parsed.Email, claims.Email)
 	}
-	if parsed.Role != claims.Role {
-		t.Errorf("Role mismatch: got %s, want %s", parsed.Role, claims.Role)
-	}
 }
 
 func TestJWTExpired(t *testing.T) {
@@ -86,7 +82,6 @@ func TestJWTExpired(t *testing.T) {
 	claims := Claims{
 		UserID: "test-user",
 		Email:  "test@example.com",
-		Role:   "user",
 		RegisteredClaims: jwt.RegisteredClaims{
 			IssuedAt:  jwt.NewNumericDate(time.Now().Add(-1 * time.Hour)),
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(-30 * time.Minute)),
@@ -109,7 +104,6 @@ func TestJWTWrongSecret(t *testing.T) {
 	claims := Claims{
 		UserID: "test-user",
 		Email:  "test@example.com",
-		Role:   "user",
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
 		},