Add cross-app super admin group; rename Executive page to Overview

- app_super_admin is a new cross-app LDAP group (also recognized by proxy
  and jump-host) that grants full admin here regardless of app_sso_admin
  membership: bypassed centrally in utils/permission.js's byGroup, folded
  into GET /api/user/me's isAdmin flag, and added to nav/forceLogin gates
  alongside app_sso_admin.
- Renamed the Executive page to Overview (route, view, API path
  /api/metrics/overview, nav label, docs), keeping /executive as a 301
  redirect alongside the existing /admin, /notifications, /dashboard
  legacy redirects.

nodejs/views/directory.ejs

@@ -73,7 +73,7 @@
 </div>
 
 <script>
-  app.auth.forceLogin(['app_sso_admin', 'app_sso_directory_admin']);
+  app.auth.forceLogin(['app_sso_admin', 'app_sso_directory_admin', 'admin']);
 
   // --- Resource modal tab content, built once. Populated via .val() in
   //     openAddModal/openEditModal AFTER app.modal.open() has (re)built the