feat(groups): add AuthKit Groups support

[gjtorikian]

Summary

• Implements all nine AuthKit Groups endpoints — CRUD + list for /organizations/{org}/groups, add/list/remove organization memberships to/from a group, and GET /user_management/organization_memberships/{om}/groups — closing the gap from Groups support? #57, where the emulator had no groups routes.
• Wires the five group.* events (created/updated/deleted, member_added/member_removed) to collection hooks, so seeded and API-created groups emit identically. The events were already declared in the generated catalog but never fired.
• Makes groups seedable: groups nest under organizations, mirroring memberships; members join by email (the same join key memberships use, since om ids are generated at startup). The config validator cross-references each member against the org's memberships and rejects typos/dangling references at startup.
• The group-members list returns the spec's slimmer UserlandUserOrganizationMembershipBase shape (no embedded user/roles), via a new formatMembershipBase helper.

Closes #57

[greptile-apps]

Greptile Summary

This PR adds complete AuthKit Groups support, including API routes, persistence, events, seed configuration, validation, and generated support documentation.

• Implements group CRUD and organization-membership management endpoints.
• Adds group and group-membership entities, collections, serialization, and event hooks.
• Supports groups nested under seeded organizations with members resolved by email.
• Adds route, event, seeding, and malformed-configuration regression coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/workos/config-validator.ts	Adds structured validation for nested groups and safely addresses both previously reported malformed-input crashes.
src/workos/routes/groups.ts	Implements the nine AuthKit Groups endpoints with organization scoping and membership operations.
src/workos/index.ts	Registers group routes, seeds groups and their memberships, and wires group lifecycle events.
src/workos/store.ts	Adds collections for groups and group-to-organization-membership joins.
src/workos/seed-groups.spec.ts	Covers group seeding, email-based membership resolution, emitted events, and the two prior malformed-configuration regressions.
src/workos/routes/groups.spec.ts	Exercises group CRUD, listing, and organization-membership endpoint behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Seed[Organization seed] --> Validate[Validate groups and member emails]
  Validate --> Memberships[Resolve organization memberships]
  Memberships --> Groups[(Groups collection)]
  Memberships --> GroupMemberships[(Group memberships collection)]
  API[AuthKit Groups routes] --> Groups
  API --> GroupMemberships
  Groups --> GroupEvents[group.created / updated / deleted]
  GroupMemberships --> MemberEvents[group.member_added / member_removed]

Loading

_{Reviews (3): Last reviewed commit: "fix(groups): guard seed validation again..." | Re-trigger Greptile}