Read async job status

Read the status and outcome of an async submission (access, members, department delete, or role-assignments). attributes.kind discriminates the job type; outcome.applied[] holds successful sub-ops and outcome.failed[] holds per-row failure objects (JSON:API errors for members/access/department.delete; { userId, roleId, code } for role-assignments.update). Lifecycle: queued → running → succeeded | partial_success | failed. partial_success applies to members.update, role-assignments.update (per-row failures), and department.delete (subtree deleted but ACL regeneration failed). access.update is binary (succeeded or failed). Unknown, malformed, or cross-tenant jobId → 404 JOB_NOT_FOUND.