SCIM: turning a domain's SCIM authority off takes effect at once (SCIM-60)

`allowScimProvisioning` is cached with the domain as DOMAIN_FLAG_SCIM, but
it wasn't among the fields whose change drops the cached entry, so flipping
the flag changed nothing until something else evicted the domain. SCIM-60
says the change takes effect without a restart.

Found by the two acceptance checks that were written but never called from
the driver, so neither had ever run: `authority` (SCIM-58 to SCIM-60,
through `synchronize_account` itself) and `rate_limits` (SCIM-14). Both are
wired in now, and `scim_tests` passes with them.

crates/common/src/cache/invalidate.rs

@@ -119,6 +119,10 @@ impl CacheInvalidationBuilder {
                     || (current.sub_addressing != new.sub_addressing)
                     || (current.allow_relaying != new.allow_relaying)
                     || (current.is_enabled != new.is_enabled)
+                    // inbuxa: SCIM-60, the flag is cached as DOMAIN_FLAG_SCIM,
+                    // so turning SCIM's authority on or off has to take effect
+                    // without a restart
+                    || (current.allow_scim_provisioning != new.allow_scim_provisioning)
                 {
                     self.invalidate(CacheInvalidation::Domain(id));
                 }

docs/spec/features/scim.md

@@ -888,6 +888,12 @@ with errors only for its generated non-address `userName`.
     `lastModified`): scim2-client builds its models from it.
   - The five `scim.*` events (SCIM-54) have ids 637 to 641, the fork's own,
     and are in the packaged schema's event list.
+  - `allowScimProvisioning` is cached with the domain, so it joins the
+    fields whose change drops that cache entry
+    (`crates/common/src/cache/invalidate.rs`); without that, SCIM-60's
+    "takes effect without a restart" held only until something else
+    evicted the domain. Found on 2026-09-19 by the two acceptance checks
+    below.
 - **Known limits, not requirements of this spec:**
   - Ending open sessions on suspension (SCIM-52) covers subscriptions to
     changes (IMAP IDLE, JMAP event streams and WebSockets), and only on the

tests/src/scim/acceptance.rs

@@ -65,6 +65,8 @@ pub async fn test(test: &TestServer, scim: &ScimTest) {
     deletion(test, scim).await;
     adoption(test, scim).await;
     tenants(test, scim).await;
+    authority(test, scim, closed_id).await;
+    rate_limits(test, scim).await;
 
     admin
         .registry_destroy(ObjectType::Domain, [closed_id])