fix(subadmin): strict boolean gate and single-source isEnabled()

Address remaining review feedback on the allow_subadmins gate:

- Tighten the gate to a strict `=== true` check so only the documented
  boolean opt-in enables the feature; string values such as 'false' or
  '0' in a hand-edited config.php now fail closed instead of fail open.
- Make SubAdmin::isEnabled() public and route settings/users.php through
  it, removing the duplicated inline config read so the gate has a single
  source of truth in the OC\SubAdmin manager.
- Document the breaking upgrade behavior in the changelog: existing
  group-admin assignments are ignored until allow_subadmins => true.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>

Author: DeepDiver1975

changelog/unreleased/41634

@@ -4,5 +4,7 @@ Disable the subadmin (group-admin) feature by default behind a new
 allow_subadmins system config, as a security risk-mitigation.
 The feature's code path has known security shortcomings; deployments
 that rely on it can opt back in with 'allow_subadmins' => true in config.php.
+On upgrade, existing group-admin assignments are ignored until an admin
+sets 'allow_subadmins' => true in config.php.
 
 https://github.com/owncloud/core/pull/41634

lib/private/SubAdmin.php

@@ -84,8 +84,8 @@ public function __construct(
 	 *
 	 * @return bool
 	 */
-	private function isEnabled() {
-		return $this->config->getSystemValue('allow_subadmins', false) !== false;
+	public function isEnabled() {
+		return $this->config->getSystemValue('allow_subadmins', false) === true;
 	}
 
 	/**

settings/users.php

@@ -72,7 +72,7 @@
 $recoveryAdminEnabled = OC_App::isEnabled('encryption') &&
 						$config->getAppValue('encryption', 'recoveryAdminEnabled', null);
 
-if ($isAdmin && $config->getSystemValue('allow_subadmins', false) !== false) {
+if ($isAdmin && \OC::$server->getGroupManager()->getSubAdmin()->isEnabled()) {
 	$subAdmins = \OC::$server->getGroupManager()->getSubAdmin()->getAllSubAdmins();
 	// New class returns IUser[] so convert back
 	$result = [];