v0.86.0 — one provider catalogue, with capabilities

Providers were named in two registries that shared nothing but a word: ProviderCatalog held eleven entries for sign-in, DirectoryProvider held three for user sync, and Google and Entra were in both with nothing connecting them.

The administrator paid for that. The directory screen could not show the guide that already existed for the same provider, so somebody who had just finished connecting Google for sign-in was handed an empty credential form and left to work out alone that a directory needs a service account with domain-wide delegation rather than the OAuth client they had just made.

Added

• A ProviderTemplate now carries what it can DO — ProviderCapability::Login, ProviderCapability::Directory — as a typed ProviderCapabilities set, with ProviderCatalog::withCapability() and ProviderCatalog::forDirectory(). Capabilities are derived from the entry's contents, never declared beside them: a hand-written list is a claim that can be false.
• DirectorySetup carries the directory guide — steps, vendor documentation, and the credentials the connector actually reads — separately from the login guide, because they describe unrelated jobs. The declared credentials are driven through the real connectors in the suite: the full set must satisfy them, and dropping any single one must not.

Fixed

• The Entra directory guidance asked for half the permissions it needs. The pull fetches groups as well as users, so User.Read.All alone got an administrator users and silently no groups. Both the connector's documentation and the catalogue entry now require Group.Read.All beside it, and the Google steps spell out that domain-wide delegation needs both read-only scopes.

Notes

• DirectoryProvider stays as the persistence type for directories.provider — a stored column is a serialization boundary, and nothing about existing rows changes.
• SCIM is deliberately not in the catalogue: it is a protocol the customer's identity provider speaks TO us, with no issuer, no vendor and no third-party documentation to link.
• Additive throughout — one trailing optional constructor argument, no existing signature changed.

Full detail in CHANGELOG.md.