SCIM /v1/scim/v2/Users, /Groups, and /Bulk are now covered by
apps/oshun/web/e2e/tenant-member-invite-scim.spec.ts against the live BFF
and local Postgres.
Path B's single Invite dialog and signed-in invitee spot-check are covered by
apps/oshun/web/e2e/tenant-member-actions.spec.ts, including /tenant/invite
browser accept and tenant-console read-back.
Remaining gaps: CSV import UI/BFF, external IdP callback, outbound email, full
SSO/MFA/onboarding first-login, operator table refresh from IdP-created rows,
and downstream audit reconciliation.
SCIM /v2/Users bulk provisioning is a tenant-admin app concern (separate app
per CLAUDE.md); the operator-facing roster view in this shell is verified.