drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/settings.go

@@ -36,7 +36,6 @@ type profileResponse struct {
 	Username    string                 `json:"username"`
 	Email       string                 `json:"email"`
 	DisplayName *string                `json:"display_name"`
-	Role        string                 `json:"role"`
 	Avatar      *string                `json:"avatar,omitempty"`
 	Settings    map[string]interface{} `json:"settings"`
 	CreatedAt   time.Time              `json:"created_at"`
@@ -84,7 +83,6 @@ func (h *SettingsHandler) GetProfile(c *gin.Context) {
 		Username:    user.Username,
 		Email:       user.Email,
 		DisplayName: dn,
-		Role:        user.Role,
 		Avatar:      avatar,
 		Settings:    settings,
 		CreatedAt:   user.CreatedAt,