Archive group

Retires a group WITHOUT deleting it: the group and its memberships are kept and stay readable (GET /groups/{id}, its members, its audit trail), but it leaves GET /groups unless archived=true|all, refuses edits and membership changes (409 group_archived), and STOPS GRANTING — its members' tokens no longer carry it, exactly as for a deleted group. Agents owned by the group are suspended, as on delete; unarchiving does not resume them. Idempotent: archiving an archived group returns it unchanged. Same gate as delete (ResourceAuth write: creator, tenant admin, system admin); 403 group_type_reserved on a group of a RESERVED type. Writes a group.archived audit record.