feat(group): 1st implementation of Groups

this implements first version (manageable only by admin right now)

    routes:

        GET /api/groups
        List subject groups (paginated). Admin-only.

        POST /api/groups
        Create a new ReBAC subject group. Admin-only. The name must match the RFC 5321 local-part shape and be globally unique (case-insensitive).

        GET /api/groups/search
        Search non-virtual groups by name substring. Authenticated only (no admin role required) — backs the share-dialog recipient autocomplete.

        GET /api/groups/{id}
        Fetch a single group's details. Admin-only.

        DELETE /api/groups/{id}
        Delete a group. Cascades to `subject_group_members` (FK) and to `access_grants` rows referencing this group as a subject. Admin-only.

        PATCH /api/groups/{id}
        Update a group's metadata. Admin-only. v1 only persists name renames.

        GET /api/groups/{id}/effective-members
        List every user transitively reached through this group (members of members of members, etc.). Used by admin / audit tooling. Admin-only.

        GET /api/groups/{id}/members
        List the *direct* members of a group (one level only). Admin-only.

        POST /api/groups/{id}/members
        Add a member to a group. Exactly one of `user_id` / `group_id` must be provided. Adding a group-member runs a write-time cycle check and a nesting-depth check (max 8). Admin-only.

        DELETE /api/groups/{id}/members/group/{gid}
        Remove a nested group-member from a group. Admin-only.

        DELETE /api/groups/{id}/members/user/{uid}
        Remove a user-member from a group. Admin-only.

fix hurl

groups

round

groups

src/common/di.rs

@@ -638,10 +638,16 @@ impl AppServiceFactory {
 
         // 3a. Authorization engine — must exist before application services
         // because services hold an Arc<PgAclEngine> for ReBAC checks.
+        // SubjectGroupPgRepository is constructed here too so the engine can
+        // expand a user's transitive group set on cache misses.
+        let subject_group_repo = Arc::new(
+            crate::infrastructure::repositories::pg::SubjectGroupPgRepository::new(pool.clone()),
+        );
         let authorization = build_authorization_engine(
             pool.clone(),
             repos.folder_repository.clone(),
             repos.file_read_repository.clone(),
+            subject_group_repo.clone(),
         );
 
         // 3b. Trash service (needed before application services)
@@ -822,6 +828,12 @@ impl AppServiceFactory {
             webdav_lock_store:
                 crate::infrastructure::services::webdav_lock_service::create_webdav_lock_store(),
             authorization,
+            subject_group_service: Some(Arc::new(
+                crate::application::services::subject_group_service::SubjectGroupService::new(
+                    subject_group_repo.clone(),
+                    pool.clone(),
+                ),
+            )),
         };
 
         // 9b. Wire admin settings service when auth is available
@@ -1147,6 +1159,10 @@ pub struct AppState {
     /// an enum dispatcher or `Arc<dyn AuthorizationEngine>` (with
     /// `async_trait` boxing).
     pub authorization: Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine>,
+    /// ReBAC subject-group management (CRUD + membership). `None` when the
+    /// auth subsystem is not configured.
+    pub subject_group_service:
+        Option<Arc<crate::application::services::subject_group_service::SubjectGroupService>>,
 }
 
 // All AppState construction is done via struct literal in build_app_state().
@@ -1162,6 +1178,7 @@ fn build_authorization_engine(
     file_repo: Arc<
         crate::infrastructure::repositories::pg::file_blob_read_repository::FileBlobReadRepository,
     >,
+    group_repo: Arc<crate::infrastructure::repositories::pg::SubjectGroupPgRepository>,
 ) -> Arc<crate::infrastructure::services::pg_acl_engine::PgAclEngine> {
     use crate::infrastructure::services::pg_acl_engine::PgAclEngine;
 
@@ -1173,5 +1190,5 @@ fn build_authorization_engine(
             "OXICLOUD_AUTHZ_ENGINE={other:?} is not yet supported. Only 'postgres' is implemented; leave the variable unset to use the default."
         );
     }
-    Arc::new(PgAclEngine::new(pool, folder_repo, file_repo))
+    Arc::new(PgAclEngine::new(pool, folder_repo, file_repo, group_repo))
 }