Add cross-app super admin group; rename Executive page to Overview

- app_super_admin is a new cross-app LDAP group (also recognized by proxy
  and jump-host) that grants full admin here regardless of app_sso_admin
  membership: bypassed centrally in utils/permission.js's byGroup, folded
  into GET /api/user/me's isAdmin flag, and added to nav/forceLogin gates
  alongside app_sso_admin.
- Renamed the Executive page to Overview (route, view, API path
  /api/metrics/overview, nav label, docs), keeping /executive as a 301
  redirect alongside the existing /admin, /notifications, /dashboard
  legacy redirects.

nodejs/routes/user.js

@@ -78,11 +78,12 @@ router.get('/me', async function(req, res, next){
 
 		// The shared client framework gates the UI on a single effective-rights
 		// flag (the OIDC-client apps send the same key). Here "admin" means
-		// membership in app_sso_admin; group-level gating still reads memberOf.
+		// membership in app_sso_admin or the cross-app app_super_admin group;
+		// group-level gating still reads memberOf.
 		const groups = (user.memberOf || []).map(function(dn){
 			return String(dn).split(',')[0].replace(/^cn=/i, '');
 		});
-		user.isAdmin = groups.includes('app_sso_admin');
+		user.isAdmin = groups.includes('app_sso_admin') || groups.includes(permission.SUPER_ADMIN_GROUP);
 
 		return res.json(user);
 	}catch(error){