feat(groups): tree repos, hierarchy-aware RBAC, admin API

Server-side foundation for Phase-2 groups (no group-owned resources yet):

Shared types:
- GroupId, Group; App gains group_id; AppRole::{precedence,max} for
  folding the highest effective role across the membership chain.

Repos:
- group_repo: tree CRUD with reparent (ancestor-walk cycle guard under a
  coarse instance-wide structural advisory lock; slug frozen; bumps
  structure_version) and delete=RESTRICT (refuses non-empty groups).
- group_members_repo: per-(user, group) role grants, mirroring app_members.

Hierarchy-aware authz (§5.3):
- AuthzRepo gains effective_app_role / effective_group_role (default to
  direct membership / none, so the ~18 existing test stubs are untouched);
  the Postgres impl resolves each via one depth-bounded recursive CTE that
  MAXes the app's own row with every ancestor group_members row.
- can(): the Member path now folds inherited group roles, so a group_admin
  on any ancestor is implicitly app_admin beneath it. New Capability
  variants InstanceCreateGroup / Group{Read,Write,Admin}; group caps carry
  no app_id (bound API keys can't manage groups). 8 new unit tests.

Admin API:
- groups_api: group CRUD + reparent (admin at both source and destination
  parent, §5.6) + per-group members, all capability-gated.
- apps: POST /apps takes an optional parent group (default root); app
  responses carry group_id; my_role now reflects the effective role.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/app.rs

@@ -9,7 +9,7 @@ use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
 
-use crate::AppId;
+use crate::{AppId, GroupId};
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct App {
@@ -20,6 +20,9 @@ pub struct App {
     pub slug: String,
     pub name: String,
     pub description: Option<String>,
+    /// Parent group in the org tree (Phase 2). Every app has a parent
+    /// from day one (§9 backfill seeds the instance root group).
+    pub group_id: GroupId,
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,
 }

crates/shared/src/auth.rs

@@ -98,6 +98,30 @@ impl AppRole {
             _ => None,
         }
     }
+
+    /// Authority rank: higher = more authority. Used to fold the highest
+    /// effective role across an app's own membership and every ancestor
+    /// group membership (hierarchy-aware RBAC). Defined explicitly rather
+    /// than via a derived `Ord` because the variant declaration order
+    /// (`AppAdmin` first) is the reverse of authority order.
+    #[must_use]
+    pub const fn precedence(self) -> u8 {
+        match self {
+            Self::AppAdmin => 3,
+            Self::Editor => 2,
+            Self::Viewer => 1,
+        }
+    }
+
+    /// The more-authoritative of two roles. `app_admin > editor > viewer`.
+    #[must_use]
+    pub fn max(self, other: Self) -> Self {
+        if self.precedence() >= other.precedence() {
+            self
+        } else {
+            other
+        }
+    }
 }
 
 /// API-key scope. Exactly seven values; new scopes need a blueprint

crates/shared/src/group.rs

@@ -0,0 +1,31 @@
+//! Groups: a GitLab-like, single-parent org tree ABOVE apps (Phase 2).
+//!
+//! Groups are a pure org / RBAC / UI container — they own no resources
+//! (scripts/secrets stay app-owned). A `group_admin` on any ancestor is
+//! implicitly app_admin on every app/subgroup beneath it; resolution
+//! takes the highest effective role across the app's own membership and
+//! all ancestor group memberships.
+//!
+//! See docs/design/groups-and-project-tool.md §5.
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use crate::GroupId;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Group {
+    pub id: GroupId,
+    /// `None` for a root node. Single-parent keeps the tree acyclic.
+    pub parent_id: Option<GroupId>,
+    /// Instance-global identifier, frozen at creation (a rename/reparent
+    /// never rewrites it — the deployment key stays stable).
+    pub slug: String,
+    pub name: String,
+    pub description: Option<String>,
+    /// Per-subtree structure version, bumped on every structural mutation
+    /// (reparent/rename/delete). Not an authz input.
+    pub structure_version: i64,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}

crates/shared/src/ids.rs

@@ -57,3 +57,4 @@ id_type!(TriggerId);
 id_type!(AppUserId);
 id_type!(InvitationId);
 id_type!(QueueMessageId);
+id_type!(GroupId);

crates/shared/src/lib.rs

@@ -15,6 +15,7 @@ pub mod events;
 pub mod exec_summary;
 pub mod execution_log;
 pub mod files;
+pub mod group;
 pub mod http;
 pub mod ids;
 pub mod inbox;
@@ -62,10 +63,11 @@ pub use files::{
     FileUpdate, FilesError, FilesListPage, FilesService, NewFile, NoopFilesService,
     SAFE_RENDER_FALLBACK,
 };
+pub use group::Group;
 pub use http::{HttpError, HttpRequest, HttpResponse, HttpService, NoopHttpService};
 pub use ids::{
-    AdminUserId, ApiKeyId, AppId, AppUserId, ExecutionId, InvitationId, QueueMessageId, RequestId,
-    ScriptId, TriggerId,
+    AdminUserId, ApiKeyId, AppId, AppUserId, ExecutionId, GroupId, InvitationId, QueueMessageId,
+    RequestId, ScriptId, TriggerId,
 };
 pub use inbox::{
     InboxDeliveryOutcome, InboxFailureKind, InboxResolver, InboxResult, NoopInboxResolver,