Merge users

Creates or updates Hub users by ext_id (When omitted, Flex defaults ext_id to "<provider>:<username>").
The provider determines the auth flow used at sign-in;
The username is the provider's public identifier (often an email address)

All users created via this endpoint are granted the global :user role.
contact_email and contact_mobile are optional and used for notifications.

Group permissions

The optional group_permissions array controls which groups the user can manage:

• Omitted (group_permissions not present): existing roles are left untouched.
• Empty array ([]): all existing group roles are cleared.
• Populated array: existing roles are replaced with the supplied set.

Only the manage role is accepted on this endpoint.