Add members in bulk

Adds many accounts to one group in a single call, reporting EVERY id's outcome rather than aborting on the first problem: added, already_member (membership is a set, so re-running an import is a no-op, not an error), not_found, or cross_tenant. Authorization is the same ResourceAuth write on the GROUP that the single-member POST runs — there is no per-account permission to add somebody to a group you may already write — so the ids in the body are data, not resources. A cross-tenant account is a row outcome here rather than the whole-request 403 the single-member path answers, because one bad line must not discard a correct import; the invariant is unchanged and such an account is never added. Duplicate ids within one call collapse, and the second mention reports already_member. One membership event and one audit record are written per member actually added, exactly as the single-member path writes them. role (member | manager, default member) applies to every ADDED member; existing members keep theirs; any other role is 400 invalid_role. 409 group_archived on an archived group. At most 1000 ids per call.