feat(admin): add group-based access scoping for routes and logs

Introduce optional route groups so non-super admins can be delegated
edit/view access to a subset of routes and their send logs.

- add Group model and Route.groupId
- add groups.ts (load/save groups, resolveScope, permission helpers)
- scope /api/routes and /api/logs by the caller's accessible groups;
  add /api/me and /api/groups (group management is super-admin only)
- require a groupId on every route in validateRoutes
- allow group admins (not just super admins) to sign in to the console

src/groups.ts

@@ -0,0 +1,58 @@
+import type { Env, Group } from "./types";
+import { isAdminUser } from "./admin-session";
+import { log } from "./log";
+
+const GROUPS_KEY = "config:groups";
+
+export async function loadGroups(kv: KVNamespace): Promise<Group[]> {
+  try {
+    const stored = await kv.get<Group[]>(GROUPS_KEY, "json");
+    if (Array.isArray(stored)) return stored;
+  } catch (err) {
+    log.warn({ err }, "Failed to load groups from KV");
+  }
+  return [];
+}
+
+export async function saveGroups(kv: KVNamespace, groups: Group[]): Promise<void> {
+  await kv.put(GROUPS_KEY, JSON.stringify(groups));
+}
+
+/** Case-insensitive match of a GitHub userId or login against a list of ids/logins. */
+export function identityMatches(ids: string[], userId: string, login: string): boolean {
+  const wanted = ids.map((s) => s.trim()).filter(Boolean);
+  if (wanted.length === 0) return false;
+  return wanted.some((id) => id === userId || id.toLowerCase() === login.toLowerCase());
+}
+
+export function isGroupAdmin(group: Group, userId: string, login: string): boolean {
+  return identityMatches(group.adminIds ?? [], userId, login);
+}
+
+export interface AccessScope {
+  isSuper: boolean;
+  /** Groups the user may view/edit. When isSuper, this is every group. */
+  groups: Group[];
+  /** Ids of accessible groups, for quick membership checks. */
+  groupIds: Set<string>;
+}
+
+export function resolveScope(
+  env: Env,
+  groups: Group[],
+  userId: string,
+  login: string,
+): AccessScope {
+  const isSuper = isAdminUser(env, userId, login);
+  const visible = isSuper ? groups : groups.filter((g) => isGroupAdmin(g, userId, login));
+  return {
+    isSuper,
+    groups: visible,
+    groupIds: new Set(visible.map((g) => g.id)),
+  };
+}
+
+/** True if the user is a super admin or manages at least one group. */
+export function hasAnyAccess(scope: AccessScope): boolean {
+  return scope.isSuper || scope.groups.length > 0;
+}