List groups the caller can data_reader on, paginated and searchable.

The members-groups page itself requires module reader (the gate above); the rows are then filtered to the groups the caller has data_reader on, so a delegate only sees their own groups while a dock operator sees all.

orgId restricts the page to those organizations; excludeOrgId omits them. The two are mutually exclusive.