[Initiative] SCIM Provisioning for Enterprise Identity

[juliuskrah]

Summary

Implement SCIM 2.0 provisioning so enterprise identity systems can automatically manage GitStore users and groups.

Scope

In scope:

• SCIM 2.0 endpoints for users and groups.
• Support create, update, deactivate, and group membership synchronization.
• Mapping enterprise identity attributes to the GitStore profile model.
• Idempotency and conflict handling for repeated provisioning events.
• Audit logging for provisioning operations.

Out of scope:

• Full HRIS integrations beyond the SCIM protocol.
• Custom proprietary provisioning APIs.
• SSO protocol implementation (tracked in [Initiative] Enterprise SSO Support #47).

Acceptance Criteria

• Enterprise IdP can provision and deprovision users through SCIM.
• Group membership changes are reflected in GitStore authorization mapping.
• SCIM operations are authenticated and audited.
• Error handling follows SCIM-compliant status and response patterns.

Dependencies

• Enterprise SSO support ([Initiative] Enterprise SSO Support #47).
• Optional user-management integration module ([Initiative] Headless User Management Module #45).

Tracking

• Milestone: TBD