Identity_provider_sync

First-time issuance and rotation are the same operation: every call replaces `scim_bearer_token_hash` with the hash of a freshly- generated 64-hex-char plaintext, and returns the plaintext to the admin once in the response. Subsequent IdpRecord reads never echo it. Returns: - `201` with `{ bearerToken, rotatedAt }` on success. - `404` if the IdpRecord doesn't exist at `(org_id, id)`. - `404` if it exists but has no `scim_config` configured — admin must enable SCIM via the regular update path before issuing a token. (Anti-enum: same 404 as "not found at all" so the endpoint doesn't leak whether the IdpRecord exists.) - `403` if the caller is not an admin. ## Atomic invalidation The `scim-bearer-hash-index` GSI is what the SCIM auth extractor uses to authenticate every inbound request. Replacing the hash in a single `PutItem` means the old hash is no longer findable after this returns — concurrent SCIM calls with the old bearer 401 on their next request. No grace window.