remove token budgets + allowed models from groups

Provider-era cruft: token_budget_daily, token_budget_monthly, and
allowed_models columns removed from groups table (both dialects).
ResolveTokenBudget() and ResolveModelAllowlist() deleted. GroupPatch
trimmed to name/description/permissions. Admin groups UI simplified
to permissions-only. -283 lines.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -27,9 +27,21 @@ All notable changes to Switchboard Core are documented here.
 - Demotion/deletion safeguards count Admins group members instead of `CountByRole`
 - Kernel permissions: 6 → 7 (added `surface.admin.access`)
 
+### Removed
+
+- **Token budgets** from groups: `token_budget_daily`, `token_budget_monthly`
+  columns, `ResolveTokenBudget()`, and all store/handler/UI code. Provider-era
+  cruft — token budgets belong in a future provider extension, not the kernel.
+- **Allowed models** from groups: `allowed_models` column,
+  `ResolveModelAllowlist()`, `toggleModel` UI. Same rationale.
+- `GroupPatch` fields: `ClearBudgetDaily`, `ClearBudgetMonthly`,
+  `ClearAllowedModels` — no longer needed
+- Admin groups UI: Token Budgets section, Allowed Models section, models API call
+
 ### Migration notes
 
-- 002_teams.sql (both dialects): added Admins group seed with all permissions
+- 002_teams.sql (both dialects): added Admins group seed, removed
+  `token_budget_daily`, `token_budget_monthly`, `allowed_models` columns
 - No new migration files — edited in place per pre-MVP policy
 
 ---