fix(tncsc_deployment): grant admin the Board Admin role so CommunityOS apps show

Every product module's backend app (Membership, School, Benefits,
Classifieds, Interac Payments) has its root menu restricted to its own
manager/coordinator group. A fresh tncsc_deployment install left the
admin user in none of them, so admin's app switcher only showed stock
apps (Events, eLearning, ...) - which looks exactly like the modules
weren't installed, even though ir.module.module.state is 'installed' for
all of them (menu visibility is group-based, not install-state-based).

Fixed by seeding admin into tncsc_deployment.group_tncsc_board_admin,
whose implied_ids already cover every product manager group - this
automates what Phase 8 previously described doing by hand for just the
School Coordinator group. Verified on a fresh install: admin's visible
root menus now include Membership/School/Benefits/Classifieds/Interac
Payments alongside the stock apps, tests still 9/9.

Also documents in HANDOFF.md that `user in group.user_ids` doesn't see
implied-group membership - use has_group() instead, which resolves the
transitive closure correctly.

HANDOFF.md

@@ -287,6 +287,26 @@ re-discovering it:
   `addons/tncsc_deployment/__init__.py` (`_remove_stock_homepage_page`,
   `_fix_website_menus`), both run from `post_init_hook`. Relevant if you
   add more top-level pages/menu items later.
+- Each product module's backend app (Membership, School, Benefits,
+  Classifieds, Interac Payments) has its root `ir.ui.menu` restricted to
+  its own manager/coordinator group, and a fresh `tncsc_deployment`
+  install doesn't put the `admin` user in any of them by default. Result:
+  admin's backend app switcher only shows stock apps (Events, eLearning,
+  Settings, ...) and none of the CommunityOS ones, which looks exactly
+  like "the modules aren't installed" even though
+  `ir.module.module.state` is `installed` for all of them — confirmed
+  by checking `env['ir.ui.menu'].with_user(admin).search([('parent_id',
+  '=', False)])`, which is the right way to check what a user actually
+  sees (menu visibility is group-based, not just install state). Fixed
+  by adding `admin` to `tncsc_deployment.group_tncsc_board_admin` in
+  `security/tncsc_roles.xml` (that group's `implied_ids` already covers
+  every product manager group) — this used to be the manual per-group
+  step described above for Phase 8's School Coordinator grant; it's now
+  automatic on any fresh install. Note `res.groups.implied_ids` doesn't
+  populate the implied group's own `user_ids` — checking membership via
+  `user in group.user_ids` will wrongly say "no" for an implied group;
+  use `user.has_group('module.xml_id')` instead, which does resolve the
+  transitive closure correctly.
 
 ## Handing off to a team
 

addons/tncsc_deployment/security/tncsc_roles.xml

@@ -27,6 +27,16 @@
             (4, ref('community_interac.group_interac_verifier')),
             (4, ref('event.group_event_manager')),
         ]"/>
+        <!-- Without this, a fresh install leaves the installing admin user
+             out of every product-module manager group, so their backend
+             app switcher only shows stock apps (Events, eLearning, ...)
+             and none of the CommunityOS ones - each app's root menu is
+             group-restricted and admin isn't a member of any of those
+             groups by default. Confirmed empirically against a live
+             container; this is the automated fix for the manual step
+             HANDOFF.md previously described doing by hand for the School
+             Coordinator group alone. -->
+        <field name="user_ids" eval="[(4, ref('base.user_admin'))]"/>
     </record>
 
     <record id="group_tncsc_treasurer" model="res.groups">