Migrate a prompt or group to a different scope

Promote-only (personal -> shared). Cascades the new scope to all descendants so children are never orphaned. Scope cannot be changed via the normal PUT; this is the only path. Requires owner/admin and that migration is enabled for the entity type.