feat(admin): groups — working, affinity, regional

[cdcore09]

Summary

Lifecycle management for the three group flavors (working / affinity / regional). Group chairs get a scoped admin surface: they can edit only the group(s) they chair; staff sees the global list.

Requirements

• Brainstorming → spec under docs/superpowers/specs/.
• /admin/groups — global list (staff+); chairs see only their groups.
• /admin/groups/:id — group page editor (description, charter, links), chair / co-chair assignment UI, member roster with role display, archive / reopen action.
• Chair assignment: add / remove group_memberships rows with role: chair | co_chair. Adding makes the assigned user an admin (per the actor-context recompute on next request).
• Public surface: existing /about/groups/* pages should render edited content once published.

Context

Foundation must ship first (#1956). Schema: groups, group_memberships, group_membership_role enum already in place from earlier work.

Implementation Notes

• Policy: canEditGroup(actor, { groupId }) — staff+ OR chairedGroupIds.has(groupId).
• This is the first subsystem where the distributed-admin pattern gets exercised; it'll be the proving ground for requirePolicy with scoped checks.