#4165 serve (token mode): --admins accepts idp-group entries that can never match

In token mode, validateAdmins in src/domain/access/serve_auth_config.ts accepts idp-group: entries in --admins, and admin_materializer turns each into an admin grant on access:*. Token-mode server tokens never carry IdP groups: the server-token create inputs default groups and collectives to empty lists (src/domain/models/access/server_token_model.ts) and the mint path never sets them. So an idp-group admin entry in token mode is accepted at startup but matches no principal, leaving the operator without the admin they configured and with no warning.

Expected: token mode refuses idp-group entries in --admins with a message naming user and group, as OAuth mode already refuses non-username entries (notPlainUsernameReason in src/serve/oauth_access_list_resolution.ts), or warns at startup.

Found while planning swamp-club#4159, which refuses the new collective subject in token-mode --admins for the same reason.