oidc groups: fix post-merge compile and migration issues

Bugs found by running the real test suite after merging upstream:

- types/types_clone.go, types/types_view.go: extend the regeneration
  guard struct literals to include the new Groups field, and add a
  UserView.Groups() accessor. Generated files normally rebuilt via
  cloner / viewer; touched by hand here pending make generate.
- db/db.go: the migration adding the groups column ran after
  202505141324, which calls ListUsers() through the User struct that
  now includes Groups. Move the column-add to 202505141323 so the
  schema is in place before any migration loads users. Register the
  new ID in the FK-disabled migration list.
- db/db.go: 202507021200 recreates all tables from inline SQL during
  the SQLite schema migration; add groups to both the CREATE TABLE
  users statement and the INSERT INTO users ... SELECT FROM users_old
  so the column survives the recreation. Also fix a copy-paste bug
  in the Rollback closure that referenced tx instead of db.
- db/schema.sql: add the groups column to the canonical schema so
  squibble.Validate accepts databases produced by the new migration
  chain. Verified against all 7 historical sqlite dumps in
  hscontrol/db/testdata/sqlite.
- types/users_test.go: the casby-oidc-claim case now exercises group
  storage; update the want to include the JSON-encoded groups column.
- integration/oidc_groups_test.go: replace the aspirational draft
  (which referenced assertNoErr, scenario.usernames, hsic.WithTLS and
  other symbols that do not exist) with a focused test that follows
  the auth_oidc_test.go pattern. Verifies the groups column directly
  via sqlite3 inside the headscale container since the gRPC User
  message does not expose Groups.

hscontrol/types/types_clone.go

@@ -35,6 +35,7 @@ var _UserCloneNeedsRegeneration = User(struct {
 	ProviderIdentifier sql.NullString
 	Provider           string
 	ProfilePicURL      string
+	Groups             string
 }{})
 
 // Clone makes a deep copy of Node.

hscontrol/types/types_view.go

@@ -124,8 +124,11 @@ var _UserViewNeedsRegeneration = User(struct {
 	ProviderIdentifier sql.NullString
 	Provider           string
 	ProfilePicURL      string
+	Groups             string
 }{})
 
+func (v UserView) Groups() string { return v.ж.Groups }
+
 // View returns a read-only view of Node.
 func (p *Node) View() NodeView {
 	return NodeView{ж: p}

hscontrol/types/users_test.go

@@ -528,6 +528,7 @@ func TestOIDCClaimsJSONToUser(t *testing.T) {
 					Valid:  true,
 				},
 				ProfilePicURL: "https://cdn.casbin.org/img/casbin.svg",
+				Groups:        `["org1/department1","org1/department2"]`,
 			},
 		},
 	}