Migrate legacy Manager members to the Custom type

Before this PR every member created with the Custom role was stored as
Manager (3) and masqueraded as Custom (4) in API responses. With the
masquerade removed, those members would suddenly surface as type 3,
which current clients no longer support and the admin panel cannot
render. Convert them to the now-persisted Custom type; access_all is
preserved and the new manage_* flags stay false, matching the exact
capabilities and appearance these members had before.

The down migration converts Custom members back to Manager so older
server versions (which cannot load type 4) keep working after a
rollback.

migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql

@@ -1,3 +1,6 @@
+-- Convert Custom members back to Manager, the representation older server versions
+-- expect (they masquerade Manager as Custom in API responses and cannot load type 4).
+UPDATE users_organizations SET atype = 3 WHERE atype = 4;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;

migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql

@@ -1,3 +1,9 @@
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE;
+-- Previously the server stored members created with the Custom role as Manager (3) and
+-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted
+-- type, convert those members so clients (which no longer know the Manager role) keep
+-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE,
+-- which matches the capabilities these members had.
+UPDATE users_organizations SET atype = 4 WHERE atype = 3;

migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql

@@ -1,3 +1,6 @@
+-- Convert Custom members back to Manager, the representation older server versions
+-- expect (they masquerade Manager as Custom in API responses and cannot load type 4).
+UPDATE users_organizations SET atype = 3 WHERE atype = 4;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;

migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql

@@ -1,3 +1,9 @@
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE;
+-- Previously the server stored members created with the Custom role as Manager (3) and
+-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted
+-- type, convert those members so clients (which no longer know the Manager role) keep
+-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE,
+-- which matches the capabilities these members had.
+UPDATE users_organizations SET atype = 4 WHERE atype = 3;

migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql

@@ -1,3 +1,6 @@
+-- Convert Custom members back to Manager, the representation older server versions
+-- expect (they masquerade Manager as Custom in API responses and cannot load type 4).
+UPDATE users_organizations SET atype = 3 WHERE atype = 4;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;

migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql

@@ -1,3 +1,9 @@
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE;
+-- Previously the server stored members created with the Custom role as Manager (3) and
+-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted
+-- type, convert those members so clients (which no longer know the Manager role) keep
+-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE,
+-- which matches the capabilities these members had.
+UPDATE users_organizations SET atype = 4 WHERE atype = 3;