feat(portal): add SSR operations and exclusive groups

docs/security-review.md

@@ -24,8 +24,9 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Velocity credentials are high-entropy bearer tokens stored only as hashes.
 - Velocity requests have a 45-second clock window and database-unique request IDs for cross-instance replay prevention.
 - Velocity and its API fail closed.
-- Registered players require at least one enabled access group; the implicit `everyone` group starts disabled.
-- Group and membership mutations re-check the Keycloak administrator role server-side and are audited.
+- Registered players require an enabled effective group; explicit assignments replace rather than combine with the protected, disabled-by-default `everyone` fallback.
+- Group and membership mutations re-check the Keycloak administrator role server-side; destructive group deletion and its audit event commit atomically.
+- Event filters accept only event types already present in the ledger, and event detail routes remain role-protected.
 - ORM-parameterized queries are used throughout.
 - CSP, clickjacking, MIME-sniffing, referrer, and browser-permission headers are configured.
 - Forwarded IP headers are ignored unless `TRUST_PROXY=true` is explicitly configured.