The enterprise slice on top of the v0.6 org core — org-scoped groups & API keys unlocking per-customer SCIM.

• First-class invite records — org invites are now listable (GET /auth/org/invites) and revocable (DELETE /auth/org/invites/{id}); re-inviting replaces the pending invite. Org + role bind to the stored record, so nothing in the accept link can be tampered with.
• Org-scoped groups & API keys via the optional OrgDirectoryStore upgrade interface (type-asserted — stores that don't implement it keep compiling; the features just 501). Per-org group namespaces gated live by RequireOrgGroupsHTTP; org-bound keys refused by every global surface, honored only by ValidateOrgAPIKeyScope.
• Per-customer SCIM — NewOrgScopedDirectory(dir, orgs, orgID) presents one org as a DirectoryStore for scim.NewServer: subjects namespaced per org, no cross-tenant email adoption/rebind (SCIM 409 → use the invite flow), deprovision = org removal (never the global account; owners refused).

Security/hardening (adversarial review): closed a cross-tenant SCIM email-rebind account-takeover, refused org-bound keys at GateHTTP/empty RequireGroupsHTTP, and corrected SCIM owner-deprovision (403) and out-of-scope group (404) status codes.

Full details in CHANGELOG.md.