[viv-4]

Problem

GET /api/engine/v2/group_users/ adds the group and the user to each row, so the
frontend can show a member list without fetching each user separately.
The user it adds was the raw Model::User, and that object's JSON includes:

• password_digest
• access_token / refresh_token (the stored SSO tokens)
• expires_at / expires

This isn't limited to admins. Any group manager sees these fields for every
member of the groups they manage.

#461 fixed the same leak in the users controller but didn't touch this one.

Fix

The embedded user is now User::PublicResponse (to_public_struct): the same
allow-listed public view that /users gives non-admins. It's the public view
for every caller, admins included, so these rows also no longer include
admin-only fields (sys_admin, support, misc, login_name, card_number,
ui_theme).

Breaking change for clients

The user object in group_users index rows now contains only the
PUBLIC_DATA fields plus id. Any client that read other fields from it
will stop getting them. Users can still get their own full profile from
GET /users/current.

Tests

New sensitive fields specs in spec/controllers/groups/user_spec.cr run as
both a group manager and a sys_admin. Each one adds a member that has a password
and SSO tokens, lists the group, and checks that:

• the embedded user has no secret keys and no admin-only keys
• the response body doesn't contain the digest or token values anywhere

Both new specs failed before the fix and pass with it. The 4 existing
group_users specs still pass.

OpenAPI

OPENAPI_DOC.yml is regenerated. GroupUser.user now points to
PlaceOS.Model.User.PublicResponse.

It also includes the /users response schema changes from #461, which never
regenerated the doc: create, update and the search endpoints now return the
response-struct union instead of PlaceOS.Model.User.