refactor(settings): fail at load when SCIM is enabled without a token

Review follow-up. SCIM_ENABLED=true with no SCIM_TOKEN was only caught per
request, as a 503 from the SCIM routes. The auth group's model validator
now rejects that combination when Settings loads, the same way it rejects
AUTH_TYPE=oidc without its required settings, so the misconfiguration is
reported once at startup rather than on the first provisioning call. The
route-level guard stays as defence in depth.

docsgpt/core/settings/auth.py

@@ -92,9 +92,11 @@ class AuthSettings(SettingsGroup):
         return normalize_choice(v)
 
     @model_validator(mode="after")
-    def _require_oidc_settings(self):
+    def _require_dependent_settings(self):
         if self.AUTH_TYPE == "oidc":
             missing = [name for name in OIDC_REQUIRED if not getattr(self, name)]
             if missing:
                 raise ValueError(f"AUTH_TYPE=oidc requires settings: {', '.join(missing)}")
+        if self.SCIM_ENABLED and not self.SCIM_TOKEN:
+            raise ValueError("SCIM_ENABLED requires settings: SCIM_TOKEN")
         return self

tests/core/test_settings.py

@@ -177,6 +177,14 @@ class TestCrossFieldRules:
     def test_oidc_settings_are_not_required_for_other_modes(self):
         assert Settings.model_validate({"AUTH_TYPE": "session_jwt"}).OIDC_ISSUER is None
 
+    @pytest.mark.parametrize("raw", [None, "", "None"])
+    def test_scim_enabled_requires_a_token(self, raw):
+        with pytest.raises(ValidationError, match="SCIM_ENABLED requires settings: SCIM_TOKEN"):
+            Settings.model_validate({"SCIM_ENABLED": True, "SCIM_TOKEN": raw})
+
+    def test_scim_disabled_needs_no_token(self):
+        assert Settings.model_validate({"SCIM_ENABLED": False}).SCIM_TOKEN is None
+
 
 @pytest.mark.unit
 class TestClosedChoices: