Replace this coverage group's standing members.

COVERAGE GROUPS CONFER SCOPE, NEVER PERMISSION. A member sees every site this group's grants cover -- off-shift included, because a manager reviewing last night must see the same sites they cover -- and gains no capability whatsoever; theirs remain exactly their role's. Shift seating is a separate thing: it says who is on the desk when, and confers nothing.

The user-side mirror is PUT /operator/{id}/coverage-groups; both write through the two ends of one relationship and share their rails.

Replace-all: the list sent IS the membership, and [] clears it (which is also how a group is prepared for deletion -- deleting one with members is refused with a 409). 409 for a structurally scoped operator (site_manager / account_manager / location_manager) or an unconfined one (owner / monitoring_manager) anywhere in the list; 404 for an unknown group or operator id.

{
  "group": {
    "name": "Overnight High-Risk",
    "color": "#4DFFD2",
    "site_count": 42,
    "members": [
      {
        "first_name": "Joe",
        "last_name": "Johnson"
      }
    ],
    "member_count": 3
  }
}