feat(groups): add fail-closed admission management

docs/security-review.md

@@ -24,12 +24,14 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Velocity credentials are high-entropy bearer tokens stored only as hashes.
 - Velocity requests have a 45-second clock window and database-unique request IDs for cross-instance replay prevention.
 - Velocity and its API fail closed.
+- Registered players require at least one enabled access group; the implicit `everyone` group starts disabled.
+- Group and membership mutations re-check the Keycloak administrator role server-side and are audited.
 - ORM-parameterized queries are used throughout.
 - CSP, clickjacking, MIME-sniffing, referrer, and browser-permission headers are configured.
 - Forwarded IP headers are ignored unless `TRUST_PROXY=true` is explicitly configured.
 - Private and reserved addresses are not sent to ProxyCheck.io; lookup results are cached to reduce disclosure and API usage.
 - Portal and game login events include approximate network location and VPN/proxy classification when available.
-- Secrets are excluded from logs and repository configuration.
+- Structured Pino logging redacts credential fields, and secrets are excluded from logs and repository configuration.
 
 ## Outstanding production requirements