Bulk import IdP users (Google Admin user export)

Creates or updates up to 500 IdP users (email + recovery email) in one request; created users get source "import". Emails are trimmed and lower-cased. Rows whose email domain is not on the organization's IdP connection allow-list (exact, case-insensitive), malformed or repeated rows are reported as invalid and never written. Each row is enriched with the current recovery email, whether the user already enrolled, and when a link was last sent. Imported users count as users: an import that would take the organization past its user limit (trial limit, or licensed seats) is rejected with 409 user_limit_exceeded before anything is written; a dry run instead returns 200 with every row, the seats and exceeded=true. When the limit cannot be checked (billing settings unavailable, or a known limit with the current users unavailable) the request fails closed with 503 seat_check_unavailable, dry runs included. With dry_run nothing is written and the response previews the outcome. Requires an organization administrator.