Add per-server access control (User.ServerIDs)

Non-admin users are now restricted to servers explicitly listed in
their new ServerIDs field; empty means no access (secure by default).
Admins always have full access. Migration backfills existing users'
ServerIDs with the migrated legacy server so nobody is locked out on
upgrade. New RequireServerAccess middleware enforces this on
/servers/:id/... routes (applied to GET /servers/:id/clients so far);
GET /servers also filters its list for non-admins.

handler/routes.go

@@ -419,6 +419,26 @@ func ListServers(db store.IStore) echo.HandlerFunc {
 				false, fmt.Sprintf("Cannot get server list: %v", err),
 			})
 		}
+
+		// non-admins only see servers they have been explicitly granted
+		if !util.DisableLogin && !isAdmin(c) {
+			user, err := db.GetUserByName(currentUser(c))
+			if err != nil {
+				return c.JSON(http.StatusForbidden, jsonHTTPResponse{false, "Access denied"})
+			}
+			allowed := make(map[string]bool, len(user.ServerIDs))
+			for _, id := range user.ServerIDs {
+				allowed[id] = true
+			}
+			var filtered []model.Server
+			for _, s := range servers {
+				if allowed[s.ID] {
+					filtered = append(filtered, s)
+				}
+			}
+			servers = filtered
+		}
+
 		return c.JSON(http.StatusOK, servers)
 	}
 }