refactor(dotcom): remove the groups_frontend flag (tldraw#9411)

In order to finish the workspaces cleanup, this PR completely removes
the `groups_frontend` feature flag and its rollout machinery. Workspaces
is fully shipped: `groups_backend` (the data migration) is at 100% and
granted to every user on signup, and `groups_frontend` (the UI flag)
recently reached 100%. With tldraw#9405 removing the last UI fork that read
the flag, nothing depends on it anymore. Relates to tldraw#8859.

**Preview deploy:** https://pr-9411-preview-deploy.tldraw.com/ — verify
the admin page (groups-enrollment section + rollout slider gone, other
sections intact) and that signup / invite-acceptance still work. No flag
is needed; every account already has `groups_backend`.

**Stacked on tldraw#9405** — that PR's branch is this one's base, so the diff
below is only the flag removal. Merge tldraw#9405 first; keeping this as a
draft until then.

- Drop the `groups_frontend` member from the `TlaFlags` enum.
- Delete the workspaces UI rollout utility (`workspacesUiRollout.ts`)
and its tests.
- Remove the admin groups-enrollment section and the rollout-percentage
slider, plus the `enroll_groups` / `unenroll_groups` / rollout-SSE
routes and the `admin_enrollInGroups` / `admin_unenrollFromGroups`
durable-object methods.
- Stop granting `groups_frontend` on user creation and invite
acceptance.
- Update the flag-parsing tests and the e2e fixture to drop the retired
flag.

The backend migration tooling is untouched: `groups_backend` stays in
the enum, and the `admin_migrateToGroups` route/method remain for
manually migrating a user's data if needed.

No data migration is required. The `user.flags` column is free-form text
(not enum-validated), so leftover `groups_frontend` tokens on existing
rows are simply ignored once nothing reads them.

### Change type

- [x] `other` (internal refactor, no user-facing change)

### Test plan

1. On the preview deploy, sign in as a normal user — confirm the app
loads and the workspaces sidebar works (file list, switcher, "Move to",
drag).
2. Accept a workspace invite — confirm it still works (the
`groups_backend` check remains; only the redundant `groups_frontend`
grant is gone).
3. Open the admin page — confirm it loads with the groups-enrollment
section and rollout slider gone, and the remaining sections (feature
flags, welcome template, delete user) intact.

- [x] Unit tests
- [ ] End to end tests

### Code changes

| Section   | LOC change |
| --------- | ---------- |
| Core code | +2 / -2    |
| Tests     | +4 / -152  |
| Apps      | +4 / -929  |

Author: jsscclr

apps/dotcom/client/e2e/fixtures/Database.ts

@@ -81,38 +81,8 @@ export class Database {
 		await sql`SELECT * FROM migrate_user_to_groups(${id}, ${inviteSecret})`.execute(db)
 	}
 
-	/**
-	 * Enable groups frontend flag for a user
-	 */
-	async enableGroupsFrontend(isOther: boolean = false): Promise<void> {
-		await this.enableGroupsFrontendByEmail(this.getEmail(isOther))
-	}
-
-	async enableGroupsFrontendByEmail(email: string): Promise<void> {
-		const id = await this.getUserIdByEmail(email)
-		if (!id) throw new Error(`User not found: ${email}`)
-
-		// Get current flags
-		const result = await sql<{
-			flags: string | null
-		}>`SELECT flags FROM public.user WHERE id = ${id}`.execute(db)
-
-		const currentFlags = result.rows[0]?.flags || ''
-		const flagsArray = currentFlags.split(/[,\s]+/).filter(Boolean)
-
-		// Add groups_frontend if not present
-		if (!flagsArray.includes('groups_frontend')) {
-			flagsArray.push('groups_frontend')
-		}
-
-		// Update with new flags
-		const newFlags = flagsArray.join(',')
-		await sql`UPDATE public.user SET flags = ${newFlags} WHERE id = ${id}`.execute(db)
-	}
-
 	async ensureGroupsReadyByEmail(email: string): Promise<void> {
 		await this.migrateUserByEmail(email)
-		await this.enableGroupsFrontendByEmail(email)
 	}
 
 	private async cleanUpUser(isOther: boolean) {

apps/dotcom/client/e2e/tests/smoke/workspaces.spec.ts

@@ -12,7 +12,6 @@ import { expect, test } from '../../fixtures/tla-test'
 test.describe('workspaces', () => {
 	test.beforeEach(async ({ database, editor }) => {
 		await database.migrateUser()
-		await database.enableGroupsFrontend()
 		await editor.isLoaded()
 		await editor.ensureSidebarOpen()
 	})