Factory adds IdP-linked groups, model controls

This is the governance layer AI coding platforms need as agent usage becomes a budget and access-control problem, not just an editor setting.

• –One group configuration replaces manual per-user administration for teams, contractors, and departments.
• –The resolution rules are powerful but nuanced: the highest group limit wins, while individual overrides take precedence.
• –Group-level model controls can tailor access by role across organizations, though customer-hosted deployments currently lack this capability.
• –Stable directory IDs preserve mappings when groups are renamed in the identity provider.