fix(auth): apply the view-only group-combination rule when a group's permissions change #1409

Follow-up to #1205, which refuses view-only plus write-capable group combinations on user create and update. UpdateGroup (internal/auth/service_group.go ~30) can still make existing memberships contradictory without any user write, for example by adding a write permission to a group that view-only users already belong to. #1205's body names this as out of scope.

Fix: on a group update that changes its permissions, check each member's resulting combination with the same rule (group_combination.go) and refuse with a 400 listing how many members would be affected, or flag them. Add tests for adding a write permission to a group whose members are also in a view-only group, and for the unchanged-permissions fast path.