Lists the store's users. Requires the Read User (p/r-user) permission. Paginated. Users are read-only through the App API: the gateway's safety denylist blocks every non-GET request under /users regardless of approved roles, so apps can never create, modify or delete users, passwords, roles, permission levels or API tokens.