Function upgrade_data_lake_schema_v10 

pub async fn upgrade_data_lake_schema_v10(
    tr: &mut Transaction<'_, Postgres>,
) -> Result<(), Error>

Upgrades the data lake schema to version 10.

Adds groups and group_members, the local-group-membership store: a group_members.member row is a selector in exactly the vocabulary audience_grants.selector uses (*, user:<email>, group:<name>), so nesting is the group: arm of the same predicate rather than a special case. Seeds the reserved admins group with a single wildcard member (('admins', '*')) on every upgrade, fresh install or not; the operator is expected to add user:<their email> to admins and then remove the wildcard row afterward, via the Groups page or micromegas-groups. Also backfills an empty group for every distinct group:X selector already present in audience_grants so a legacy claim-derived grant is not left dangling at an unknown name.