Add User Groups feature to Identity & Blazor UI

- Introduce Group, GroupRole, UserGroup entities and migrations
- Add permissions and endpoints for group CRUD and membership
- Implement group-based role inheritance for users
- Seed system groups ("All Users", "Administrators")
- Update claims generation to include group roles
- Add Blazor UI for group management and membership
- Extend API client for new group endpoints and DTOs
- Automatically add new users to default groups
- Add IGroupRoleService for resolving group-derived roles

Author: iammukeshm

src/BuildingBlocks/Shared/Identity/IdentityPermissionConstants.cs

@@ -25,4 +25,13 @@ public static class Sessions
         public const string ViewAll = "Permissions.Sessions.ViewAll";
         public const string RevokeAll = "Permissions.Sessions.RevokeAll";
     }
+
+    public static class Groups
+    {
+        public const string View = "Permissions.Groups.View";
+        public const string Create = "Permissions.Groups.Create";
+        public const string Update = "Permissions.Groups.Update";
+        public const string Delete = "Permissions.Groups.Delete";
+        public const string ManageMembers = "Permissions.Groups.ManageMembers";
+    }
 }

src/Modules/Identity/Modules.Identity.Contracts/DTOs/GroupDto.cs

@@ -0,0 +1,14 @@
+namespace FSH.Modules.Identity.Contracts.DTOs;
+
+public class GroupDto
+{
+    public Guid Id { get; set; }
+    public string Name { get; set; } = default!;
+    public string? Description { get; set; }
+    public bool IsDefault { get; set; }
+    public bool IsSystemGroup { get; set; }
+    public int MemberCount { get; set; }
+    public IReadOnlyCollection<string>? RoleIds { get; set; }
+    public IReadOnlyCollection<string>? RoleNames { get; set; }
+    public DateTime CreatedAt { get; set; }
+}

src/Modules/Identity/Modules.Identity.Contracts/DTOs/GroupMemberDto.cs

@@ -0,0 +1,12 @@
+namespace FSH.Modules.Identity.Contracts.DTOs;
+
+public class GroupMemberDto
+{
+    public string UserId { get; set; } = default!;
+    public string? UserName { get; set; }
+    public string? Email { get; set; }
+    public string? FirstName { get; set; }
+    public string? LastName { get; set; }
+    public DateTime AddedAt { get; set; }
+    public string? AddedBy { get; set; }
+}

src/Modules/Identity/Modules.Identity.Contracts/Services/IGroupRoleService.cs

@@ -0,0 +1,15 @@
+namespace FSH.Modules.Identity.Contracts.Services;
+
+/// <summary>
+/// Service for retrieving roles derived from group memberships.
+/// </summary>
+public interface IGroupRoleService
+{
+    /// <summary>
+    /// Gets all role names that a user has through their group memberships.
+    /// </summary>
+    /// <param name="userId">The user ID to get group roles for.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>List of distinct role names from all groups the user belongs to.</returns>
+    Task<IReadOnlyList<string>> GetUserGroupRolesAsync(string userId, CancellationToken ct = default);
+}

src/Modules/Identity/Modules.Identity.Contracts/v1/Groups/AddUsersToGroup/AddUsersToGroupCommand.cs

@@ -0,0 +1,7 @@
+using Mediator;
+
+namespace FSH.Modules.Identity.Contracts.v1.Groups.AddUsersToGroup;
+
+public sealed record AddUsersToGroupCommand(Guid GroupId, List<string> UserIds) : ICommand<AddUsersToGroupResponse>;
+
+public sealed record AddUsersToGroupResponse(int AddedCount, List<string> AlreadyMemberUserIds);

src/Modules/Identity/Modules.Identity.Contracts/v1/Groups/CreateGroup/CreateGroupCommand.cs

@@ -0,0 +1,10 @@
+using FSH.Modules.Identity.Contracts.DTOs;
+using Mediator;
+
+namespace FSH.Modules.Identity.Contracts.v1.Groups.CreateGroup;
+
+public sealed record CreateGroupCommand(
+    string Name,
+    string? Description,
+    bool IsDefault,
+    List<string>? RoleIds) : ICommand<GroupDto>;

src/Modules/Identity/Modules.Identity.Contracts/v1/Groups/DeleteGroup/DeleteGroupCommand.cs

@@ -0,0 +1,5 @@
+using Mediator;
+
+namespace FSH.Modules.Identity.Contracts.v1.Groups.DeleteGroup;
+
+public sealed record DeleteGroupCommand(Guid Id) : ICommand<Unit>;

src/Modules/Identity/Modules.Identity.Contracts/v1/Groups/GetGroupById/GetGroupByIdQuery.cs

@@ -0,0 +1,6 @@
+using FSH.Modules.Identity.Contracts.DTOs;
+using Mediator;
+
+namespace FSH.Modules.Identity.Contracts.v1.Groups.GetGroupById;
+
+public sealed record GetGroupByIdQuery(Guid Id) : IQuery<GroupDto>;

src/Modules/Identity/Modules.Identity.Contracts/v1/Groups/GetGroupMembers/GetGroupMembersQuery.cs

@@ -0,0 +1,6 @@
+using FSH.Modules.Identity.Contracts.DTOs;
+using Mediator;
+
+namespace FSH.Modules.Identity.Contracts.v1.Groups.GetGroupMembers;
+
+public sealed record GetGroupMembersQuery(Guid GroupId) : IQuery<IEnumerable<GroupMemberDto>>;

src/Modules/Identity/Modules.Identity.Contracts/v1/Groups/GetGroups/GetGroupsQuery.cs

@@ -0,0 +1,6 @@
+using FSH.Modules.Identity.Contracts.DTOs;
+using Mediator;
+
+namespace FSH.Modules.Identity.Contracts.v1.Groups.GetGroups;
+
+public sealed record GetGroupsQuery(string? SearchTerm = null) : IQuery<IEnumerable<GroupDto>>;