Support SCIM-provisioned users belonging to multiple organizations

In enterprise deployments a single corporate identity frequently needs membership in several organizations — e.g. a central platform/operations team that administers many tenant orgs, or an engineer contributing/needing read access across multiple orgs. With the single-org constraint, that cross-org access must be handled outside SCIM (SSO/OIDC only) or via duplicate identities, which breaks automated provisioning/de-provisioning and makes an org's user roster impossible to fully SCIM-manage.

No files or tests are named. Start by locating the SCIM provisioning entry point and the code enforcing the single-organization membership constraint; trace how provisioning and de-provisioning update organization rosters, then establish tests for multi-organization membership and complete roster synchronization.

Written by the indexing model from the issue text.