feat(scim): add Users [id] route — GET + PUT + PATCH + DELETE + POST 405

- GET /scim/v2/Users/{id}: bearer + getScimUserById; 200 with SCIM resource,
  404 on ScimNotFoundError, 500 fallback.
- PUT /scim/v2/Users/{id}: bearer + zod body validation + putScimUser; 200
  with updated resource; maps ScimNotFoundError -> 404, ScimValidationError
  -> carried envelope, ScimUniquenessError + Prisma P2002 -> 409 uniqueness.
- PATCH /scim/v2/Users/{id}: bearer + thin zod PatchOp shape (Operations
  non-empty) + patchScimUser; 200 with updated resource; ScimPatchApplyError
  returns the carried 400 envelope verbatim (preserves scimType:mutability /
  invalidSyntax from the patch wrapper); ScimNotFoundError -> 404.
- DELETE /scim/v2/Users/{id}: bearer + deleteScimUser; 204 No Content with
  explicit Content-Type: application/scim+json so IdPs can identify the SCIM
  surface even on an empty body; 404 on ScimNotFoundError.
- POST on the resource route returns 405 SCIM envelope (POST only valid on
  the collection root).
- 24 route tests using vi.mock on the auth + services + patch modules; zero
  new deps.

Author: therealbrad