[Story]: De-provisioning semantics tied to budget and API-key revocation

## Summary
Wire SCIM de-provisioning (user deactivate/delete) to immediate budget and API-key revocation, so an offboarded employee loses platform access in the same action an admin takes in the IdP.

## Intent / Source of truth
De-provisioning-on-offboarding is a control auditors specifically check for (SOC 2 CC6.x access-revocation criteria); a SCIM deactivate call that doesn't actually cut off access is worse than no SCIM at all — it's a false sense of security. Part of [Epic] SCIM 2.0 provisioning and de-provisioning.

## Scope
- [ ] SCIM `active: false` PATCH triggers immediate API-key revocation
- [ ] Budget allocation zeroed/frozen on de-provisioning
- [ ] Audit log entry generated for every de-provisioning event
- [ ] Configurable grace period vs immediate cutoff (customer policy choice)

## Out of scope
- Data export/retention workflows for the deactivated user's history (separate concern)

## Verification
Test asserting a SCIM deactivate call results in zero valid API keys and zero remaining budget within the same request cycle; audit log entry present and correctly attributed.

## Risk assessment
A race between an in-flight request and revocation could let one extra call through; document the acceptable window rather than claim instantaneous cutoff if it isn't.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

No files or existing entry points are named. Start by locating the SCIM handler for deactivate and tracing API-key, budget, and audit-log behavior in the same request cycle. Done means the verification test covers zero valid keys, zero remaining budget, correct attribution, configurable grace-period behavior, and the documented in-flight-request window.

Escrito por el modelo de indexación a partir del texto del issue.