feat(portal): add SSR operations and exclusive groups

design/us-017-group-access.md

@@ -3,7 +3,7 @@ type: User Story
 title: Control Minecraft admission with groups
 description: Administrators assign users to groups and enable Minecraft access through explicit group policy.
 tags: [admin, groups, authorization, velocity, security]
-timestamp: 2026-08-01T22:36:20Z
+timestamp: 2026-08-01T23:10:59Z
 story_id: US-017
 status: verified
 ---
@@ -14,20 +14,22 @@ As an administrator, I want to organize registered users into access groups, so
 
 # Acceptance Criteria
 
-- [x] Every registered user implicitly belongs to the protected `everyone` group.
-- [x] The `everyone` group is created with Minecraft access disabled.
-- [x] Administrators can create groups with access disabled by default.
-- [x] Administrators can add and remove users from non-default groups.
+- [x] A registered user can have at most one explicit group assignment.
+- [x] Users without an explicit assignment fall back to the protected `everyone` group.
+- [x] The `everyone` group remains created with Minecraft access disabled.
+- [x] Administrators can create groups with access disabled by default and move users between groups.
 - [x] Administrators can enable or disable Minecraft admission for each group.
-- [x] A registered player is admitted when any assigned group has access enabled.
-- [x] A registered player is denied when none of their groups has access enabled.
+- [x] Admission follows only the user's effective group; default and explicit-group access are never combined.
+- [x] Administrators can delete non-default groups, returning affected users to `everyone`.
+- [x] The protected default group cannot be deleted.
 - [x] Group creation, membership, and access-policy changes are audited.
-- [x] Users and administrators can inspect the user's effective group assignments.
+- [x] Users and administrators can inspect the user's single effective group assignment.
 
 # Implementation
 
 - [`packages/database/src/schema.ts`](../packages/database/src/schema.ts)
 - [`packages/database/drizzle/0002_simple_queen_noir.sql`](../packages/database/drizzle/0002_simple_queen_noir.sql)
+- [`packages/database/drizzle/0003_smiling_silver_samurai.sql`](../packages/database/drizzle/0003_smiling_silver_samurai.sql)
 - [`apps/web/src/app/admin/(console)/groups/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/page.tsx)
 - [`apps/web/src/app/admin/(console)/groups/[groupId]/page.tsx`](../apps/web/src/app/admin/%28console%29/groups/%5BgroupId%5D/page.tsx)
 - [`apps/web/src/app/api/velocity/access/route.ts`](../apps/web/src/app/api/velocity/access/route.ts)