organisations: Sync user lists by diff, not clear and re-add

[theresnotime]

users_update_lists cleared each organisation's username list and
added all users again every hour. Each run used new ids in the join
table. This used all of the 32-bit id space.

Now the command compares the API list with the stored list. It adds
only the new users and removes only the missing users. A run with no
changes adds no rows.

Also:

• Set a timeout on the API request.
• Raise an error on a non-200 response and on a bad payload.
• Process each organisation in its own try/except, and log the
  exception. One bad organisation does not stop the batch.
• Do not empty a list that has users when the API sends an empty
  list.
• Update username_list_updated only after a sync is successful.

Assisted-by: Claude Opus 5.5
Bug: T434714

[jsnshrmn]

LGTM!