fix(models): admin allow-list now binds every non-admin, on every feature

Two holes in the Admin -> allowed models setting.

isRestrictedStudent was keyed on user_group membership, so anyone added
outside a group was unrestricted -- including every account between creation
and being put in a group. It is now simply 'not an admin'.

The workflow machinery bypassed the list entirely: blueprintModel() and
/compile called bare resolveModel(null, DEFAULT_MAIN_MODEL), and workflow runs
were created with model: null so the executor fell back to DEFAULT_MAIN_MODEL
unchecked -- every step and every partner review. All three now resolve
through resolveModelForUser, and the executor clamps again at run time so a
recovered run cannot keep calling a model since removed from the list.

This was benign only by coincidence: DEFAULT_MAIN_MODEL is
gemini-3-flash-preview, which is currently allowed. Removing it would have
left every workflow run calling it anyway.

Verified: the only bare resolveModel() calls left are in routes/user.ts for
displaying and validating stored preferences, neither of which reaches a
model. 3 admins exempt, 36 non-admins restricted, 0 stored prefs out of
policy.