Get groups by organization (paginated)

Unlike "Get groups by organization" (GET /organizations/{organization}/groups), which authorizes each group individually via its ACL, this endpoint requires organization-wide group read permission and does no per-group filtering. It is therefore not a drop-in replacement: callers without org-wide group read receive an error rather than a filtered subset.

The q parameter uses the shared filter syntax. Bare terms (including multi-word) perform a free-text search over group name and display name. search: is the only accepted key and unknown keys return 400. Because group display names may contain colons, a value with a colon must be quoted, e.g. search:"team: frontend"; an unquoted colon fails with Query element "team:" cannot start or end with ':'.

This endpoint returns group summaries without the member roster: each group carries only total_member_count and no members field. Callers that need the roster use the group members endpoint (GET /groups/{group}/members).