List custom user groups (admin-defined groups with kind 'derived',
'explicit', or 'hybrid') for the caller's company. Supports optional
search by slug prefix or display name substring, and optional kind
filter. Returns member_count per group — does not include the
membership definition recipe. Cursor-paginated.

Required OAuth scope: user:read