oidc groups: fix post-merge compile and migration issues

Bugs found by running the real test suite after merging upstream:

- types/types_clone.go, types/types_view.go: extend the regeneration
  guard struct literals to include the new Groups field, and add a
  UserView.Groups() accessor. Generated files normally rebuilt via
  cloner / viewer; touched by hand here pending make generate.
- db/db.go: the migration adding the groups column ran after
  202505141324, which calls ListUsers() through the User struct that
  now includes Groups. Move the column-add to 202505141323 so the
  schema is in place before any migration loads users. Register the
  new ID in the FK-disabled migration list.
- db/db.go: 202507021200 recreates all tables from inline SQL during
  the SQLite schema migration; add groups to both the CREATE TABLE
  users statement and the INSERT INTO users ... SELECT FROM users_old
  so the column survives the recreation. Also fix a copy-paste bug
  in the Rollback closure that referenced tx instead of db.
- db/schema.sql: add the groups column to the canonical schema so
  squibble.Validate accepts databases produced by the new migration
  chain. Verified against all 7 historical sqlite dumps in
  hscontrol/db/testdata/sqlite.
- types/users_test.go: the casby-oidc-claim case now exercises group
  storage; update the want to include the JSON-encoded groups column.
- integration/oidc_groups_test.go: replace the aspirational draft
  (which referenced assertNoErr, scenario.usernames, hsic.WithTLS and
  other symbols that do not exist) with a focused test that follows
  the auth_oidc_test.go pattern. Verifies the groups column directly
  via sqlite3 inside the headscale container since the gRPC User
  message does not expose Groups.

hscontrol/db/db.go

@@ -215,6 +215,27 @@ AND auth_key_id NOT IN (
 				},
 				Rollback: func(db *gorm.DB) error { return nil },
 			},
+			// Add groups column to users table for OIDC role mapping.
+			// Must run before any migration that loads users via the User struct
+			// (e.g., 202505141324), since the User struct now includes Groups.
+			{
+				ID: "202505141323",
+				Migrate: func(tx *gorm.DB) error {
+					if !tx.Migrator().HasColumn(&types.User{}, "groups") {
+						err := tx.Migrator().AddColumn(&types.User{}, "groups")
+						if err != nil {
+							return fmt.Errorf("adding groups column to users table: %w", err)
+						}
+					}
+					return nil
+				},
+				Rollback: func(db *gorm.DB) error {
+					if db.Migrator().HasColumn(&types.User{}, "groups") {
+						return db.Migrator().DropColumn(&types.User{}, "groups")
+					}
+					return nil
+				},
+			},
 			// Fix the provider identifier for users that have a double slash in the
 			// provider identifier.
 			{
@@ -315,6 +336,7 @@ AND auth_key_id NOT IN (
   provider_identifier text,
   provider text,
   profile_pic_url text,
+  groups text,
   created_at datetime,
   updated_at datetime,
   deleted_at datetime
@@ -381,8 +403,8 @@ AND auth_key_id NOT IN (
 
 					// Copy data directly using SQL
 					dataCopySQL := []string{
-						`INSERT INTO users (id, name, display_name, email, provider_identifier, provider, profile_pic_url, created_at, updated_at, deleted_at)
-             SELECT id, name, display_name, email, provider_identifier, provider, profile_pic_url, created_at, updated_at, deleted_at
+						`INSERT INTO users (id, name, display_name, email, provider_identifier, provider, profile_pic_url, groups, created_at, updated_at, deleted_at)
+             SELECT id, name, display_name, email, provider_identifier, provider, profile_pic_url, groups, created_at, updated_at, deleted_at
              FROM users_old`,
 
 						`INSERT INTO pre_auth_keys (id, key, user_id, reusable, ephemeral, used, tags, expiration, created_at)
@@ -447,28 +469,6 @@ AND auth_key_id NOT IN (
 				},
 				Rollback: func(db *gorm.DB) error { return nil },
 			},
-			// Add Groups column to users table for OIDC role-based access control
-			{
-				ID: "202509161200",
-				Migrate: func(tx *gorm.DB) error {
-					// Add Groups column to store OIDC group memberships as JSON
-					if !tx.Migrator().HasColumn(&types.User{}, "groups") {
-						err := tx.Migrator().AddColumn(&types.User{}, "groups")
-						if err != nil {
-							return fmt.Errorf("adding groups column to users table: %w", err)
-						}
-						log.Info().Msg("Added Groups column to users table for OIDC role mapping")
-					}
-					return nil
-				},
-				Rollback: func(db *gorm.DB) error {
-					// Remove Groups column on rollback
-					if tx.Migrator().HasColumn(&types.User{}, "groups") {
-						return tx.Migrator().DropColumn(&types.User{}, "groups")
-					}
-					return nil
-				},
-			},
 			// v0.27.1
 			{
 				// Drop all tables that are no longer in use and has existed.
@@ -1000,6 +1000,7 @@ func runMigrations(cfg types.DatabaseConfig, dbConn *gorm.DB, migrations *gormig
 			"202502131714",
 			"202502171819",
 			"202505091439",
+			"202505141323",
 			"202505141324",
 
 			// As of 2025-07-02, no new IDs should be added here.

hscontrol/db/schema.sql

@@ -12,6 +12,7 @@ CREATE TABLE users(
   provider_identifier text,
   provider text,
   profile_pic_url text,
+  groups text,
 
   created_at datetime,
   updated_at datetime,