SCIM provisioning #34

No SCIM endpoints exist. Larger customers can't have their own IdP push User lifecycle events (create, update, deactivate, and group or org membership) into the hub.

Spec: Roadmap → Phase 3, plan-remaining.md → Phase 3.

Trigger: a customer large enough to require it. It will most likely arrive alongside the SSO broker work.

Scope:

• SCIM 2.0 /Users and /Groups (mapped to Organization memberships), scoped to one Organization
• A SCIM bearer credential per Organization (probably an Organization-scoped API Key)
• Map deactivation onto the existing suspend and revoke path, so access.revoked fires
• Audit events, OpenAPI, tests, and the Changelog