Adds staff-only permission scopes to a user. Scopes not listed are left untouched, as are all non-staff custom permissions. The caller may only add scopes their own admin scopes authorise: partly_admin authorises every staff-only scope, and each area admin (e.g. partly_qa_admin) authorises its base scope and itself. A user_id with no Partly account returns user_not_found — create the account with users.invite-v3 first.