feat: expose is_builtin on AdminGroup and add a built_in filter param

[ericfitz]

Summary

The client cannot reliably identify built-in (seeded) groups. CreateAdminGroup assigns Provider: BuiltInProvider ("tmi") to every admin-created group (api/admin_group_handlers.go), the same provider the six seeded groups get, and AdminGroup carries no is_builtin field. Expose the distinction in the API.

Background

Found while implementing ericfitz/tmi-ux#806 (Built-in badge + filter on the admin groups page). The client currently works around it by matching the seeded group names (everyone, security-reviewers, administrators, confidential-project-reviewers, embedding-automation, tmi-automation) transcribed from api/seed/seed.go — a list that silently drifts if seeding changes — and its filter toggle can only express provider=tmi, which selects seeded and admin-created groups. See the discussion on ericfitz/tmi-ux#806 (comment from PR ericfitz/tmi-ux#814).

Acceptance Criteria

• AdminGroup (admin groups list/detail responses) includes a boolean is_builtin that is true only for server-seeded groups
• GET /admin/groups accepts a built_in boolean filter param usable alongside the existing provider/group_name filters and pagination
• OpenAPI spec updated so the client codegen picks both up

Notes

• Implementation likely needs a persisted flag (column set at seed time) rather than a name match, so admin-created groups can never collide with a future seeded name.
• Client follow-up once this lands: replace the hard-coded name list in admin-groups.component.ts (BUILT_IN_GROUP_NAMES) with is_builtin, and repoint the "Show TMI groups only." toggle (or add a second, accurate "built-in only" filter) — tracked on feat: admin groups — usage badge tooltips, built-in badge and filter toggle tmi-ux#806.