Auth

Setting a first password for a user now creates an associated email identity, while SCIM adds /ResourceTypes, /Schemas, and /ServiceProviderConfig endpoints. Fixes include clearing pending phone changes, revoking outstanding email tokens on email replacement, and correcting identity-unlink behavior with autoconfirm.

This is a release candidate. See release-please PR #2681 for context.

SCIM router is now behind an experimental feature flag. Access tokens from banned users are rejected, last_sign_in_at persists on v2 refresh token issuance, and the offline_access OAuth scope is accepted for MCP refresh clients.

This is a release candidate. See release-please PR #2637 for context.

This is a release candidate. See release-please PR #2637 for context.