Grant Membership

Add one company membership to a user, or change its role (admin).

The additive counterpart to PUT /users/{id}, which replaces a user's whole membership set. That was the only way to grant one tenant: read the user, add an entry, send the entire desired list back. Two operators editing one person concurrently then silently drop each other's grant — no conflict, no error, nothing in the response to notice — and companies: [] deletes every membership, so a client that mis-computes the set removes all of somebody's access on a request meant to add one.

Idempotent on the role: granting a role the user already holds changes nothing, and granted_by is re-stamped only when the role actually changes, so re-sending a grant does not re-attribute the original decision to whoever sent it last.

404 for an unknown user; 422 for an unknown company, checked before the row is written — the membership FK would otherwise raise a bare IntegrityError and answer 500 for a typo. (422 rather than 404 because the company arrives in the BODY, matching what PUT /users/{id} already answers for the same mistake.)