Move members to another group

Moves accounts from this group to to_group_id in ONE transaction, so nobody is ever in neither group (reorganising teams no longer needs a remove and an add per person). The route authorizes a write on THIS group; the target is checked separately with the same write decision, so the caller must be able to add members to both (403 target_forbidden otherwise). The target must be a different, non-archived group in the same tenant (400 invalid_target). Every id reports an outcome: moved, not_member (not in this group), not_found, cross_tenant, or the agent fence's agent_consent_required / not_group_member for a service account entering the target. An account already in the target just leaves this group and reports moved. role sets the target role; omitted, each member keeps their role. Each mover gets a removed + added membership event and audit record pair (metadata.via = move). 409 group_archived if either group is archived. At most 1000 ids per call.