Implement SCIM

Provision users and groups from a directory. Then stop.

Guardrails

• MUST call verifyWebhookPayload before reading the event. Invalid signature → 400. Do not process it.
• MUST upsert. The same user_created can arrive twice.
• MUST deactivate on organization.directory.user_deleted. MUST NOT hard-delete unless the repo already does.
• MUST NOT generate the admin portal. Name implement-sso instead.

Gotchas