Changes to Create or REPLACE one `identity-providers:` definition (upsert), persisted to the config overlay and live after an atomic rebuild-and-swap. A base-config-defined entry is 409 (edit config.yaml); RAISING `max_admin_scope` is refused outright (the trust ceiling is operator file policy)

put/api/v1/admin/identity-providers/{name}