Update Group Mappings

Replace the complete authoritative group-access mapping (self-hosted admin only).

Organizations and projects referenced by the mapping become managed by identity-provider groups. On each user's next sign-in, memberships and roles in those scopes are reconciled against their current provider groups, so existing manual access may be changed or removed.

Membership in a user's own personal organization is never removed. Organizations and projects not referenced by the mapping are left unchanged, and only projects explicitly listed in project_roles are managed. Removing a scope from the mapping stops managing it but does not restore access changed or removed by an earlier reconciliation. When multiple matching groups grant roles in the same scope, the most permissive mapped role is applied.

Every organization_name and project_name in the payload must correspond to an existing record, and every group_id must be unique; otherwise a 400 is returned. A 409 is returned when an environment-configured mapping overrides API-managed mappings.