Grants a staff member access to the vendor portal. The email is normalised to
lowercase; the person signs in with a passwordless magic link sent to that address —
no invitation email is sent by this endpoint, so tell them to sign in at the portal.

Rules:

• role: Admin (full access, can manage users and integrations) or Limited
  (day-to-day booking and patient work). Defaults to Limited.
• locationScope: All, Selected or None — which locations' bookings the user
  sees in the portal. When Selected, locationIds is required, must be non-empty,
  and every id must be one of your locations (400 unknown_location naming the bad
  id). When All or None, sending a non-empty locationIds fails with 400
  scope_mismatch. Note this scoping applies to portal users only — API keys always
  see all locations.
• An email that already has portal access returns 409 duplicate_user.
• Enum inputs are matched case-insensitively and stored in canonical casing;
  unrecognised values are rejected (nothing is silently defaulted).

The addition is recorded in your activity log.