Remove members in bulk

Removes many accounts from one group in a single call, reporting every id as removed or not_member. The verdict comes from the delete itself rather than a read beforehand, so two operators undoing the same bad import cannot both be told they removed someone. A POST rather than a DELETE because it carries a body. Same ResourceAuth write on the group as every other membership change, and one membership event plus one audit record per member actually removed — removal hard-deletes the row, so that audit record is the only durable trace the person was ever in the group. At most 1000 ids per call.