feat(admin): add group-based access scoping for routes and logs

Introduce optional route groups so non-super admins can be delegated
edit/view access to a subset of routes and their send logs.

- add Group model and Route.groupId
- add groups.ts (load/save groups, resolveScope, permission helpers)
- scope /api/routes and /api/logs by the caller's accessible groups;
  add /api/me and /api/groups (group management is super-admin only)
- require a groupId on every route in validateRoutes
- allow group admins (not just super admins) to sign in to the console

src/types.ts

@@ -40,6 +40,17 @@ export interface Route {
     threadId?: string;
   };
   lang?: string;
+  groupId?: string;
+}
+
+export interface Group {
+  id: string;
+  name: string;
+  /**
+   * GitHub user ids or logins (case-insensitive) allowed to manage this group.
+   * Super admins (ADMIN_USER_IDS) always have access regardless of this list.
+   */
+  adminIds: string[];
 }
 
 export interface Filter {