Add API support for managing and retrieving user lists

[krowvin]

Summary

Add CWMS Data API support for database-level user-lists concept so clients can create, manage, and retrieve lists of users.

Problem

There is currently no API support for a general-purpose reusable list of users. Would liek to see client be able to define a list of existing CWMS users and retrieve that list with user identity data such as name and email.

This should be separate from the existing authorization/security-group behavior unless there is a strong reason to couple them.

Dependency

This depends on cwms-database schema support for:

• AT_USER_LISTS
• AT_USER_LIST_MEMBERS
• a retrieval view for list membership and user profile fields

Proposed API Capabilities

Support endpoints to:

• Create a user list
• Update a user list
• Delete a user list
• List user lists for an office
• Add a user to a list
• Remove a user from a list
• Retrieve members of a list

Expected Response Data

List member retrieval should return, at minimum:

• office id
• user list id
• user id / username
• full name
• email

Proposed Considerations

• Reuse existing CWMS users; do not create duplicate user records
• Align with current office-aware API patterns
• Keep implementation straightforward and SQL-backed
• Avoid coupling this feature to Oracle-specific behavior
• Define authorization rules for who may create/update/delete lists versus only read them

Possible Endpoint Shapes

Examples only:

• GET /user/list
• POST /user/list
• GET /user/list/{userListId}
• PATCH /user/list/{userListId}
• DELETE /user/list/{userListId}
• GET /user/list/{userListId}/members
• POST /user/list/{userListId}/members
• DELETE /user/list/{userListId}/members/{userId}

Related Context

Potentially related existing API concerns:

• new-user profile retrieval
• list-users access-management work
• broader access-management and authorization features

Acceptance Criteria - Possible tests

• API can create and delete user lists
• API can add and remove existing users from a list
• API can return members of a list with name and email
• API behavior is covered by integration or endpoint tests
• API works against the schema-backed implementation without requiring PL/SQL-specific logic in the contract

Related to HydrologicEngineeringCenter/cwms-database#159