Provider-era cruft: token_budget_daily, token_budget_monthly, and
allowed_models columns removed from groups table (both dialects).
ResolveTokenBudget() and ResolveModelAllowlist() deleted. GroupPatch
trimmed to name/description/permissions. Admin groups UI simplified
to permissions-only. -283 lines.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>