Add per-server access control (User.ServerIDs)

Non-admin users are now restricted to servers explicitly listed in
their new ServerIDs field; empty means no access (secure by default).
Admins always have full access. Migration backfills existing users'
ServerIDs with the migrated legacy server so nobody is locked out on
upgrade. New RequireServerAccess middleware enforces this on
/servers/:id/... routes (applied to GET /servers/:id/clients so far);
GET /servers also filters its list for non-admins.

model/user.go

@@ -7,4 +7,8 @@ type User struct {
 	// PasswordHash takes precedence over Password.
 	PasswordHash string `json:"password_hash"`
 	Admin        bool   `json:"admin"`
+	// ServerIDs restricts a non-admin user to only these servers.
+	// Empty/nil means no server access at all (secure by default).
+	// Admins always have access to every server regardless of this field.
+	ServerIDs []string `json:"server_ids,omitempty"`
 }