Add roles/groups with a `groups` claim (for RP authorization)Verified

Per-user groups stored as multi-valued usher_credentials (kind "group"):
user-groups / add-user-group / remove-user-group / user-in-group-p. Emitted as
a `groups` claim in both the ID token and UserInfo so relying parties (e.g.
cave's cave-admin check) can authorize. 192 checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>