Add office-scoped user-list API and management UI

[krowvin]

Refs #1733.

Summary

Adds the complete, authenticated CDA user-list feature for office-scoped recipient groups:

• office-scoped user-list metadata CRUD
• list membership read and management endpoints
• candidate-member lookup
• owner and office authorization behavior
• schema/feature gating for installations without the database objects
• Groundwork-styled CDA UI for creating, editing, and deleting lists and managing members
• ADR documenting the CDA user-list context, ownership, office scope, API, and UI decisions

Related Issue

Closes #1733

Database foundation: HydrologicEngineeringCenter/cwms-database#160. Two follow-up database commits for office scoping and CDA grants remain local for review before a separate database PR.

Validation

• latest origin/develop fetched and merged: already up to date
• :cwms-data-api:integrationTests --tests cwms.cda.api.users.UserListControllerTestIT: 5 passed
• :cwms-data-api:test --tests cwms.cda.features.CdaFeatureManagerProviderTest: 6 passed with the local runtime feature override isolated
• CDA UI npm run lint: passed
• CDA UI source Prettier check: passed
• CDA UI npm run build: passed
• broad Gradle build completed compilation, WAR packaging, and the bundled UI build; its unit-test phase still reports unrelated existing Windows/JDK 21 fixture and Mockito failures

Checklist

• AI tools used

[krowvin]

Drafting until DB changes are in. Did one endpoint to start so i can check performance of the endpoints as I go.

[MikeNeilson]

Seems like a reasonable start.

[MikeNeilson]

long term, I'd probably group these by "/user/list" rather that method -> "/user/..."

But that's just me.

[krowvin]

Added the next user-list GET endpoint under /user/list:

GET /user/list/{user-list-id}?office={office}

Returns metadata for a single office-scoped user list

Separate from the existing members endpoint.

EDIT: Going to resolve conflicts at the end when it's ready for merge (not draft)

[krowvin]

Spoke with Mike N on 07/24/2026

Needs to be behind a feature flag (togglez) to make sure the DB has it. This will make it not show it in swagger. and a proper unsupported response. Minimum schema version enum.

Also to go ahead and PR this to have all the GET/POST/DELETE/etc for one larger review.

All the user stuff should have add user handlers/function for grouping so things are more clear.