"""Identity consumer credentials — the machine-auth layer of the
outbound *pull* surface (Directory API + SCIM server).

Helix is the company's authoritative identity source. The Identity
Sync Center covers the *push* direction (Helix → SaaS); this package
covers the *pull* direction: an external system registers as an
``IdentityConsumer``, holds one or more ``helix_svc_`` service tokens,
and calls the read-only Directory / SCIM endpoints with the scopes and
person-filter an admin granted it.

Deliberately NOT a person credential: PATs (``helix_pat_``) bind to an
employee and inherit that employee's RBAC — wrong shape for
system-to-system integration where the credential must survive any
individual's offboarding and carry its own narrow grants.
"""