Assigns users to a user group. Additive: users already in the group are reported back in existingUsers and left untouched, so the call is safe to retry. Every id is validated before any is written, so one bad id rejects the whole request. Candidate and deleted accounts cannot be assigned, and system user groups are refused because their membership is derived from roles.