SCIM 2.0 user provisioning

Org-scoped System for Cross-domain Identity Management (SCIM 2.0) lets an identity provider create, update, and deprovision DekEn accounts automatically — deactivating a user the moment the IdP marks them active=false — so IT doesn't manage users by hand in two systems.

• An enterprise customer's IT team wants user lifecycle (joiners/movers/leavers) driven entirely from their IdP
• You need an employee's DekEn access revoked the instant they're offboarded in the IdP, not on the next manual audit
• You're issuing or rotating the SCIM bearer token for a new IdP integration

Exposes a SCIM 2.0 Users endpoint scoped to one organization; the IdP authenticates with a per-org SCIM token and pushes create/update/deactivate operations, which map onto the same underlying user + org-membership model SSO and manual invites use.