[CXH-2281] - Fix SCIM account-lifecycle defects and rebuild test-server for doc fidelity

.github/actions/start-test-server/action.yml

@@ -15,7 +15,11 @@ runs:
       run: go build -o test-server ./cmd/test-server
       shell: bash
     - name: Start test server
-      run: ./test-server &
+      # Pass the SCIM bearer through so the mock's -scim-token stays in lockstep
+      # with BATON_LUCID_SCIM_TOKEN. The mock requires distinct REST/SCIM tokens;
+      # if these diverge, every SCIM route 401s. Falls back to the mock's own
+      # default when the var is unset (e.g. a fork without repo secrets).
+      run: ./test-server -scim-token "${BATON_LUCID_SCIM_TOKEN:-test-scim-token}" &
       shell: bash
     - name: Wait for test server
       run: |

.github/workflows/ci.yaml

@@ -9,8 +9,11 @@ env:
   BATON_LOG_LEVEL: debug
   # Credentials + endpoints for the in-process mock (cmd/test-server). No real
   # Lucid tenant, OAuth credentials, or rotating refresh token are involved: the
-  # mock serves the OAuth2 token endpoint, the REST API and SCIM. Any non-empty
-  # bearer is accepted. The connector derives the OAuth token URL from BATON_BASE_URL.
+  # mock serves the OAuth2 token endpoint, the REST API and SCIM. As in
+  # production, the REST and SCIM surfaces require DIFFERENT bearer tokens: the
+  # mock rejects the SCIM token on REST routes and enforces BATON_LUCID_SCIM_TOKEN
+  # on SCIM routes, so it is passed through to the mock's -scim-token by the
+  # start-test-server action. The connector derives the OAuth token URL from BATON_BASE_URL.
   BATON_LUCID_API_KEY: test-api-key
   BATON_LUCID_CLIENT_ID: test-client-id
   BATON_LUCID_CLIENT_SECRET: test-client-secret