Add students to a group

Idempotently add students to the group.

Per JSON:API to-many relationship POST semantics, this is idempotent: if the student is already a member, the existing membership is returned as succeeded — there is no separate already_a_member error code.

Within-batch duplicate detection is first-wins on id: the first occurrence is processed; subsequent occurrences are pre-marked duplicate_in_batch with the JSON:API source pointer at /data/{i}/id.

Returns 404 if the group is not in the caller's organization. The group lookup runs before the envelope guard so a missing group is reported as 404 regardless of body content — clients can't infer group existence from the 400-vs-404 boundary.

Required OAuth scope: student-groups:write