Rebuild admin pages around DataTable/AdminModal; restructure categories/groups and v2 groups API

Remove the generic $lib/svelte-admin CRUD layer and AdminTable.svelte; each
admin route now owns its own form/modal logic. Add DataTable.svelte,
superform-errors.ts, and profile-specific modal/field components.

Flatten proclamation categories/groups and drop subscription levels; add the
v2 groups API; update v1/v2 endpoints, serializers, auth, and regenerated
Prisma client with the new migrations.

Document the overhaul plan in docs/ADMIN_OVERHAUL.md.

src/routes/(protected)/admin/api-keys/+page.server.ts

@@ -2,11 +2,12 @@ import type { PageServerLoad } from './$types';
 import { error } from '@sveltejs/kit';
 import { prisma } from '$lib/db';
 import { rotateApiKey } from '$lib/server/api-key';
-import { ROLES } from '$lib/svelte-admin/roles';
+
+const SUPER = 1;
 
 export const load: PageServerLoad = async ({ locals, parent }) => {
 	const { adminUser } = await parent();
-	if (adminUser.roleId > ROLES.SUPER) {
+	if (adminUser.roleId > SUPER) {
 		throw error(403, 'Only Super admins can manage API keys');
 	}
 
@@ -49,7 +50,7 @@ async function viewerRoleId(locals: App.Locals): Promise<number> {
 
 export const actions = {
 	rotate: async ({ locals }) => {
-		if ((await viewerRoleId(locals)) > ROLES.SUPER) {
+		if ((await viewerRoleId(locals)) > SUPER) {
 			return { success: false, error: 'Not authorized' };
 		}
 
@@ -62,7 +63,7 @@ export const actions = {
 		};
 	},
 	rotateEmergency: async ({ locals }) => {
-		if ((await viewerRoleId(locals)) > ROLES.SUPER) {
+		if ((await viewerRoleId(locals)) > SUPER) {
 			return { success: false, error: 'Not authorized' };
 		}