drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/middleware/page_auth.go

@@ -61,27 +61,23 @@ func AuthOrRedirect(cfg *config.Config, users store.UserStore, cache *UserStatus
 			return
 		}
 
-		// Resolve user role — redirect (not JSON) on any failure.
-		var role string
+		// Check user is active — redirect (not JSON) on failure.
 		if entry, hit := cache.get(claims.UserID); hit {
 			if !entry.isActive {
 				redirectToLogin(c, loginPath)
 				return
 			}
-			role = entry.role
 		} else {
 			user, err := users.GetByID(c.Request.Context(), claims.UserID)
 			if err != nil || !user.IsActive {
 				redirectToLogin(c, loginPath)
 				return
 			}
-			cache.set(claims.UserID, user.IsActive, user.Role)
-			role = user.Role
+			cache.set(claims.UserID, user.IsActive)
 		}
 
 		c.Set("user_id", claims.UserID)
 		c.Set("email", claims.Email)
-		c.Set("role", role)
 		c.Next()
 	}
 }