Attach one role to a batch of the company's active users in a single step.

Handy for migration (put everyone on the same company role at once) and for recovery — selecting all users and assigning the global full_user role restores broad access after a botched migration. Additive only: it never removes a role, so it's safe to re-run and doesn't undo anything; strip stale roles afterward via the per-user move flow.

The role must be this company's own or a shared global role (never the staff kobalt_admin). DB-only like the rest of the migration flow (nothing mirrored to SuperTokens); caches are cleared per newly-attached user so the change takes effect at once.