Mirrors Meta's POST /{audienceId}/users.

• Body is payload: { schema, data } — schema names the hashed fields (e.g. ["EMAIL_SHA256"]), data is the array of SHA-256 hashed values. Meta rejects unhashed PII with its own validation error; this endpoint never hashes or inspects the payload itself.
• Removing users (DELETE .../users with a body) is not yet exposed.
• Write — needs a write-scoped token.