Add opt-in group member user mapping via email

[Doug Guthrie (dpguthrie)]

Summary

• add opt-in group member user mapping (MIGRATION_GROUP_MAP_USERS / --group-map-users)
• add optional auto-invite fallback for missing destination users (MIGRATION_GROUP_AUTO_INVITE_USERS / --group-auto-invite-users)
• keep default behavior unchanged (group member_users skipped unless mapping enabled)
• document caveat: mapping is currently applied during group create payload; no follow-up patch reconciliation for pre-existing destination groups

Implementation

• extend migration config/env parsing and validation for new group mapping flags
• wire new CLI flags into migrate flow
• implement email-based source->destination user resolution + optional invite/retry in GroupMigrator
• map resolved destination user IDs into group member_users payload

Tests

• added integration tests for group member user mapping:
  • mapping + auto-invite flow
  • mapping disabled flow
• added unit tests for group mapping + config validation
• validated targeted suite:
  • uv run pytest tests/integration/test_acl_user_mapping_flow.py tests/integration/test_group_user_mapping_flow.py tests/unit/test_group_migrator.py tests/unit/test_config.py

Notes

• Full uv run pytest in this branch still shows known unrelated failures in existing concurrency/streaming suites.