Admin 'manage user' edit sheet silently requires a group, asymmetric with the create form

[joshunrau]

Summary

The admin "Manage" sheet for a user cannot save any edit unless the user has at least one group — and the create-user form allows creating a user with none. The result is a user who can be created but never edited, with no visible reason.

Where

• apps/web/src/routes/_app/admin/users/index.tsx — the update schema .check() pushes an inline "Standard user must be part of a group" issue whenever groupIds is empty for any role other than ADMIN.
• apps/web/src/routes/_app/admin/users/create.tsx — groupIds is fully optional.

The two forms disagree, so a GROUP_MANAGER/STANDARD user created with no groups is permanently unsavable from the Manage sheet.

Repro

1. Create a user via the API (or the create form) with no groupIds
2. Open /admin/users → row actions → "Manage"
3. Change only the Email field, click Submit

Result: no request fires, no toast, and no top-level error. The only signal is an inline field error next to "Groups", which is off-screen unless you scroll.

Suggested fix

Make the two schemas agree — either require a group at creation for non-admin roles, or drop the requirement on update. Whichever way, surface the failure at the top of the sheet rather than only inline, since the submit otherwise looks like a no-op.

Notes

Found while writing the Playwright suite (branch e2e-tests). testing/src/specs/admin-management.spec.ts seeds its user with a group to work around this.