AddMember now detects FK violations on user_id and returns ErrUnknownUser, mapped to 404 unknown_user in writeGroupError. HandleListMembers calls GetByID first so a nonexistent group yields 404 instead of 200 with empty members. Adds handler tests for both cases plus a PATCH permissions semantics table test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>