feat(admission): add group VPN exceptions

design/us-013-admin-user-management.md

@@ -3,7 +3,7 @@ type: User Story
 title: Manage users as an administrator
 description: Authorized operators search users and maintain their names, linked accounts, primaries, and Discord nicknames.
 tags: [admin, users, minecraft, discord]
-timestamp: 2026-08-01T22:34:31Z
+timestamp: 2026-08-02T14:12:43Z
 story_id: US-013
 status: verified
 ---
@@ -24,12 +24,17 @@ As an administrator, I want to manage a user's identity and Minecraft accounts,
 - [x] Administrators can set a new primary account and automatically update Discord.
 - [x] Every action rechecks role and account ownership and records the acting administrator.
 - [x] Discord failures do not falsely persist the requested name, primary, or removal change.
+- [x] Each row in the administrator user registry shows the user's effective group in an accessible dropdown.
+- [x] Selecting a group immediately applies the assignment; selecting `everyone` removes the explicit assignment.
+- [x] Group changes preserve the active user search and show accessible success or error feedback.
+- [x] Registry assignment changes revalidate administrator authorization, user existence, and group existence, and audit the previous and new effective groups.
 
 # Implementation
 
 - [`apps/web/src/app/admin/(console)/users/page.tsx`](../apps/web/src/app/admin/%28console%29/users/page.tsx)
 - [`apps/web/src/app/admin/(console)/users/[userId]/page.tsx`](../apps/web/src/app/admin/%28console%29/users/%5BuserId%5D/page.tsx)
 - [`apps/web/src/app/admin/(console)/users/actions.ts`](../apps/web/src/app/admin/%28console%29/users/actions.ts)
+- [`apps/web/src/components/user-group-select.tsx`](../apps/web/src/components/user-group-select.tsx)
 
 # Validation