drop users.role column: full RBAC through group membership

The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/js/sw/sdk/api-domains.js

@@ -166,7 +166,7 @@ export function createDomains(restClient) {
                 create:        (data)              => rc.post('/api/v1/admin/users', data),
                 del:           (id)                => rc.del(`/api/v1/admin/users/${id}`),
                 resetPassword: (id, pw)            => rc.post(`/api/v1/admin/users/${id}/reset-password`, { password: pw }),
-                updateRole:    (id, role)          => rc.put(`/api/v1/admin/users/${id}/role`, { role }),
+                updateRole:    (id, isAdmin)       => rc.put(`/api/v1/admin/users/${id}/role`, { is_admin: isAdmin }),
                 toggleActive:  (id, active, opts)  => rc.put(`/api/v1/admin/users/${id}/active`, { is_active: active, ...opts }),
                 permissions:   (id)                => rc.get(`/api/v1/admin/users/${id}/permissions`),
                 resetVault:    (id)                => rc.post(`/api/v1/admin/users/${id}/vault/reset`, {}),