drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -287,7 +287,6 @@ func main() {
 			HeaderFingerprint: cfg.MTLSHeaderFingerprint,
 			AutoActivate:      cfg.MTLSAutoActivate,
 			DefaultTeam:       cfg.MTLSDefaultTeam,
-			DefaultRole:       cfg.MTLSDefaultRole,
 		})
 	case auth.ModeOIDC:
 		var err error
@@ -299,7 +298,6 @@ func main() {
 			RedirectURL:        cfg.OIDCRedirectURL,
 			AutoActivate:       cfg.OIDCAutoActivate,
 			DefaultTeam:        cfg.OIDCDefaultTeam,
-			DefaultRole:        cfg.OIDCDefaultRole,
 			RolesClaim:         cfg.OIDCRolesClaim,
 			GroupsClaim:        cfg.OIDCGroupsClaim,
 			AdminRole:          cfg.OIDCAdminRole,