Segment members export #7417

Scope

Async export of every identity matching a segment in an environment, written to S3 as JSONL. One row per identity, payload shape matching the existing identity-list endpoint (identifier, identity_key, traits). Triggered via POST /api/v1/projects/{project_id}/segments/{id}/members/export?env={env_id}; the endpoint enqueues a task and returns 202 with a job ID. Job status is queryable via GET /api/v1/segment-membership-exports/{job_id} returning state, row count, and a presigned download URL once complete.

Storage: project-scoped S3 prefix (segment-membership-exports/{org_id}/{project_id}/{job_id}.jsonl). Default 7-day retention via S3 lifecycle.

Spend tag for the underlying Snowflake query: flagsmith:segment_membership:export:org_<id>:project_<id>.

Acceptance criteria

• POST .../members/export enqueues a task and returns {job_id, status: "pending"} with 202.
• GET .../segment-membership-exports/{job_id} returns state transitions: pending → running → completed | failed.
• Completed responses include a presigned url valid for 24 hours, and valid_until.
• Export rows match the segment-members listing endpoint's payload shape.
• RBAC: MANAGE_SEGMENTS on the project plus VIEW_IDENTITIES on the environment.