End-User Groups

Tenant-scoped groups. Use with policy user_scope matchers, per-group rate-limit overrides, and group-targeted bulk operations.