SCIM 2.0 Provisioning for Automatic User & Group Sync

Add SCIM 2.0 support so identity providers (Microsoft Entra ID, Okta, OneLogin, JumpCloud, etc.) can automatically push users and groups to DeployHQ.

Use case: Enterprise customers managing identity through IdPs like Entra need automatic group-to-team mapping for SOC 2 compliance. Without SCIM, team membership must be managed manually in DeployHQ, creating additional audit burden and manual procedures.

What it would do:

- IdP pushes groups and users to DeployHQ via standard SCIM 2.0 endpoints

- Admins link IdP groups to DeployHQ teams via a dropdown

- Team membership stays in sync automatically — including offboarding

- Works with any SCIM 2.0-compatible IdP