Phase 4 of the SCIM v2 implementation:
- The two hardcoded 'useScim: false' sites in organization.rs now report
CONFIG.scim_enabled(), so clients see the truthful capability flag.
manageScim stays false: management is via the /api endpoints, not the
web vault's enterprise UI.
- docs/scim/README.md: operator setup, token generation/rotation, the
full Entra ID enterprise-app walkthrough with attribute mappings, and
the documented deviations (DELETE=revoke, no role sync, no post-create
rename sync).
- docs/scim/design.md: architecture and security model with four mermaid
diagrams (provision/deprovision sequence, membership state machine
including the -128/-127/-126 revocation offsets, the guard decision
flow with uniform-401 sinks, and the module map), the sha256-vs-argon2
rationale, and the E2EE constraint analysis explaining why confirm
cannot be server-side.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>