fix(apiserver): enforce self_ug job scopes and accept project filters (bug-1934, bug-1935)

bug-1934: every job-permission check read a single scope and compared it
only with "self", so a job:view or job:control grant scoped to self_ug acted
like "all" (list, get by ID, control), and self + self_ug collapsed to self.
userJobScope() now collects all of a user's grants of a job permission
before deduplication and adds them up (all; self; self_ug = the user and
everyone sharing a user group). The job list appends a submit_user filter
for narrower scopes, get-by-ID keeps covered rows in a new slice (removing
from the ranged slice skipped rows) and answers 403, both control paths
and job output check the owner against the scope. User groups now reach
the apiserver: the config push converts cluster_config_t.ugroups and
OnUserGroupsUpdated() replaces the new store (nested groups, all,
exclusions). The default basic_user now also sees its user-group mates'
jobs, as its configuration says.

bug-1935: project_name and license_project are accepted job filters, so
xcecli jobs list -P works.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/frontend/apiserver/models/jobs.go

@@ -175,8 +175,8 @@ var JOB_SUPPORT_FILTERS = []string{
 	"job_id",
 	//"user_group",
 	//"job_group",
-	//"project_name",
-	//"license_project",
+	"project_name",    // bug-1935: xcecli jobs list -P
+	"license_project", // bug-1935: xcecli jobs list --license-project
 	//"sla",
 	"submit_time",
 	"queue_time",

src/frontend/apiserver/models/usergroups.go

@@ -0,0 +1,10 @@
+package models
+
+// UserGroupInfo is a user group from the cluster configuration
+// (users.yaml usergroups). A member is a user name, another group's name or
+// "all"; ExMembers are removed from the group (bug-1934).
+type UserGroupInfo struct {
+	Name      string   `json:"name"`
+	Members   []string `json:"members"`
+	ExMembers []string `json:"exclude_members"`
+}