- Renamed is_staff label to 'Доступ к панели администратора' with
clearer help text explaining it's for IT admins only
- Removed is_staff from the standard Authentication fieldset
- Added get_fieldsets() override: superusers get an extra collapsed
'Системный доступ' tab with is_staff and user_permissions
- Remove Employee.role CharField — was a display-only label with no
actual permission logic
- 3 migrations: create groups, migrate data, remove field
- Admin: list/filter/fieldset now use groups; added groups_display method
- Serializer: role → groups (SlugRelatedField returning group names)
- Template: get_role_display → groups.first.name
- EmployeePermissionOverride and PermissionGroup remain for fine-grained
per-employee and per-group permission management
lokses