drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/models/models.go

@@ -23,12 +23,9 @@ const (
 	ScopePersonal = "personal"
 )
 
-// ── Role Constants ──────────────────────────
+// ── Team Role Constants ─────────────────────
 
 const (
-	UserRoleUser  = "user"
-	UserRoleAdmin = "admin"
-
 	TeamRoleAdmin  = "admin"
 	TeamRoleMember = "member"
 )
@@ -48,7 +45,6 @@ type User struct {
 	PasswordHash string     `json:"-" db:"password_hash"`
 	DisplayName  string     `json:"display_name,omitempty" db:"display_name"`
 	AvatarURL    string     `json:"avatar_url,omitempty" db:"avatar_url"`
-	Role         string     `json:"role" db:"role"`
 	IsActive     bool       `json:"is_active" db:"is_active"`
 	Settings     JSONMap    `json:"settings,omitempty" db:"settings"`
 	LastLoginAt  *time.Time `json:"last_login_at,omitempty" db:"last_login_at"`