Yes, this did the trick! The group existed, but somebody had renamed it - since this basically breaks core functionality I am wondering whether renaming of system groups should be disallowed in the UI.
For the records, in case somebody ends up in a similar situation:
docker exec -it app /bin/bash
su - postgres
psql -d discourse
discourse=# update groups set name='staff' where id=3;
\q