Grant a partner staff member a role in the client, or change it (partner admins only)

The grant and its Core access commit first, then the Clerk membership is created or updated. A Clerk failure answers 200 with syncState failed and syncError; retry it with the retry route. The same role again changes nothing (a grant keeps a narrower Core role it was moved in with). 422 NOT_PARTNER_STAFF when the user is not a member of the partner's organization. 409 GRANT_REVOKING while the grant is being revoked; 409 ALREADY_DIRECT_MEMBER when the user is already a member of the client without a partner grant (the client admin removes that membership first); 409 GRANT_CONFLICT when another request created the user's grant at the same time (read the grants and try again). 403 IMPERSONATED_SESSION for an impersonated session.