Function get_groups 

pub async fn get_groups(
    infra: &InfraContext<'_>,
    token: &str,
    params: &GetGroupParams,
) -> Result<Vec<Group>, Error>

List HSM groups visible to the caller.

When params.group_name is set the lookup is scoped to that single label; otherwise it spans every group the token already grants access to. Group access is re-validated before the backend call so the response can’t leak labels the caller couldn’t have listed directly.