[Story]: SCIM 2.0 Users endpoint (create, read, update, deactivate)

## Summary
Implement the SCIM 2.0 Users endpoint (RFC 7644) so an IdP can create, read, update and deactivate lightbridge user accounts without manual admin action.

## Intent / Source of truth
This is the baseline SCIM primitive every enterprise IdP integration depends on; without it there is no automated provisioning path at all. Part of [Epic] SCIM 2.0 provisioning and de-provisioning.

## Scope
- [ ] `/Users` CRUD endpoints matching the SCIM 2.0 core schema
- [ ] Bearer-token SCIM client authentication scoped to a provisioning-only role
- [ ] Filtering/pagination per RFC 7644 section 3.4.2
- [ ] Mapping SCIM attributes onto existing lightbridge-authz account fields

## Out of scope
- Groups endpoint (separate story)
- Bulk operations extension

## Verification
Integration tests covering create/read/update/deactivate against the SCIM schema validator; a manual Postman/curl walkthrough recorded in the PR.

## Risk assessment
A malformed SCIM implementation is a common enterprise-onboarding blocker discovered too late (mid-pilot); conformance testing must happen before any customer pilot, not after.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Begin with the `/Users` endpoint scope and RFC 7644, including section 3.4.2 for filtering and pagination. Use the SCIM schema validator to define integration coverage for create, read, update and deactivate, and verify bearer-token authentication and account-field mapping. Done means the integration tests pass and the Postman/curl walkthrough is recorded in the PR.

Written by the indexing model from the issue text.