chore(accesslogs): drop UserGroups field — nothing populates it

UserGroups on AccessLogEntry was a server-side enrichment artefact: the
proto AccessLog message never carried it, so the only writer was
manager.enrichUserGroups at save time. Without that writer the field
stays nil forever and the dashboard's user_groups column is always
empty — better to remove the dead surface than ship an unused field.

The dashboard can still reverse-resolve groups from UserId when it
needs them, accepting the tradeoff that memberships are resolved at
display time rather than captured at write time.

- AccessLogEntry.UserGroups field removed (no GORM column either).
- ToAPIResponse stops emitting the user_groups key.
- openapi.yml user_groups field removed; types.gen.go regenerated.
- enrichUserGroups + its test removed.

management/internals/modules/reverseproxy/accesslogs/accesslogentry.go

@@ -39,10 +39,6 @@ type AccessLogEntry struct {
 	BytesDownload   int64             `gorm:"index"`
 	Protocol        AccessLogProtocol `gorm:"index"`
 	Metadata        map[string]string `gorm:"serializer:json"`
-	// UserGroups captures the group IDs the user (UserId) belonged to at
-	// the time the entry was written, so the dashboard can render group
-	// context without reverse-resolving stale memberships.
-	UserGroups []string `gorm:"serializer:json"`
 }
 
 // FromProto creates an AccessLogEntry from a proto.AccessLog
@@ -129,12 +125,6 @@ func (a *AccessLogEntry) ToAPIResponse() *api.ProxyAccessLog {
 		metadata = &a.Metadata
 	}
 
-	var userGroups *[]string
-	if len(a.UserGroups) > 0 {
-		groups := append([]string(nil), a.UserGroups...)
-		userGroups = &groups
-	}
-
 	return &api.ProxyAccessLog{
 		Id:              a.ID,
 		ServiceId:       a.ServiceID,
@@ -155,6 +145,5 @@ func (a *AccessLogEntry) ToAPIResponse() *api.ProxyAccessLog {
 		BytesDownload:   a.BytesDownload,
 		Protocol:        protocol,
 		Metadata:        metadata,
-		UserGroups:      userGroups,
 	}
 }