drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/interfaces.go

@@ -93,9 +93,6 @@ type UserStore interface {
 
 	// ── CS2 additions (v0.29.0) ──
 
-	// CountByRole returns the number of users with a given role.
-	CountByRole(ctx context.Context, role string) (int, error)
-
 	// CountAll returns the total number of users.
 	CountAll(ctx context.Context) (int, error)