Re-run the Keycloak group sync for an existing tenant. Idempotent.

Create provisions the group best-effort, so a KC outage leaves a tenant with none — and every member operation then 400s. Re-POSTing the same name used to paper over that by creating a second row; uq_tenants_name (0012) now rejects it, so the sync needs a door of its own. Failures surface here rather than being logged and swallowed: syncing the group is the only thing this call does.