Auth: User JWT

Batch update chat user fields (firstName / lastName / username / profileImage / email).

Auth model: User JWT with appUsers.update Acl, or B2B Server JWT targeting the token's own app.

Lookup: each item must include uuid OR xmppUsername. The xmppUsername (when supplied) MUST start with <reqUser.appId>_ (the calling token's app id). This strict prefix check is intentional and catches a common SDK foot-gun: wrappers that double-prefix the xmppUsername (e.g. <appId>_<appId>_<id>). When acting on a CHILD app from a parent-app token, the prefix can never match this route's expectation - prefer the path-explicit PATCH /v2/apps/{appId}/chats/users (tenant-actor auth) instead.

Per-user statuses (in results[] / details[]):

• updated - row updated, fresh user snapshot returned
• not-found - no user matched {uuid|xmppUsername, appId}
• skipped - no updatable fields present in the item
• invalid - payload-shape rejection (e.g. xmppUsername prefix mismatch, email already in use by another user in this app)

The HTTP status is always 200 when the request itself was well- formed; clients MUST inspect each item's status to know if an individual user actually changed.

{
  "users": [
    {
      "xmppUsername": "<appId>_<userId>"
    }
  ]
}

{ ok: true, summary, results, details }

{
  "ok": true,
  "results": [
    {
      "status": "updated"
    }
  ],
  "details": [
    {
      "status": "updated"
    }
  ]
}