feat(groups): add fail-closed admission management

design/us-013-admin-user-management.md

@@ -3,7 +3,7 @@ type: User Story
 title: Manage users as an administrator
 description: Authorized operators search users and maintain their names, linked accounts, primaries, and Discord nicknames.
 tags: [admin, users, minecraft, discord]
-timestamp: 2026-08-01T18:43:58Z
+timestamp: 2026-08-01T22:34:31Z
 story_id: US-013
 status: verified
 ---
@@ -16,7 +16,7 @@ As an administrator, I want to manage a user's identity and Minecraft accounts,
 
 - [x] Administrators can search by preferred name, Discord username or ID, Minecraft username, or UUID.
 - [x] Search results show onboarding state, primary username, and active account count.
-- [x] A user detail view shows Discord identity, active accounts, recent events, and recent IP observations.
+- [x] A user detail view shows Discord display name, username, guild nickname, immutable ID, active accounts, groups, recent events, and recent IP observations.
 - [x] Administrators can update the preferred name and synchronize Discord.
 - [x] Administrators can add Mojang-verified accounts or explicitly override an unverified username.
 - [x] Administrators can remove an account only after a visible confirmation step.
@@ -39,3 +39,4 @@ Nickname fallback behavior is tested in [`packages/minecraft/test/minecraft.test
 
 - [Administrator SSO](us-011-admin-sso.md)
 - [Synchronize Discord nicknames](us-006-discord-nickname.md)
+- [Control Minecraft admission with groups](us-017-group-access.md)