feat: add groups management API

- GET /auth/groups - list groups with search/pagination
- POST /auth/groups/sync-from-authentik - bulk sync from Authentik
- Group model and database migration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

alembic/versions/20260101_0002_002_create_groups_table.py

@@ -0,0 +1,40 @@
+"""Create groups table
+
+Revision ID: 002
+Revises: 001
+Create Date: 2026-01-01
+
+Creates the groups table for syncing Authentik groups.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "002"
+down_revision: Union[str, None] = "001"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Groups table
+    op.create_table(
+        "groups",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("authentik_id", postgresql.UUID(as_uuid=True), nullable=False, comment="Authentik group UUID"),
+        sa.Column("name", sa.String(255), nullable=False),
+        sa.Column("is_superuser", sa.Boolean(), nullable=False, server_default="false", comment="Whether members have superuser privileges"),
+        sa.Column("parent_name", sa.String(255), nullable=True, comment="Parent group name for hierarchy"),
+        sa.Column("member_count", sa.Integer(), nullable=False, server_default="0", comment="Number of users in this group"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("synced_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False, comment="Last sync from Authentik"),
+    )
+    op.create_index("ix_groups_authentik_id", "groups", ["authentik_id"], unique=True)
+    op.create_index("ix_groups_name", "groups", ["name"], unique=True)
+
+
+def downgrade() -> None:
+    op.drop_table("groups")