test: Add identity provider integration tests

[mashawes]

Adds integration test coverage for the identity provider, following the existing test patterns and harness.

• Group CRUD under tests/integration/src/identity/group/: create, get (including not-found), list (including filtering by domain), and delete.
• User lifecycle: a delete test, a get_user_domain_id test, and a find_federated_user test (creating a user with a federated identity and looking it up by idp/unique id, plus the not-found case).
• Group membership under tests/integration/src/identity/user_group/: remove and set, bulk add_users_to_groups and remove_user_from_groups, and the expiring variants (add, remove, remove-many, set), complementing the existing add/list coverage.
• All tests use the existing harness (get_state, create_domain!, create_user!, create_group!) and the public provider API; no production code is changed. authenticate_by_password is exercised by the token integration tests.

Closes #449

Note: this contribution was developed with AI assistance.

[gtema]

generally good, but we need some refinements:

• add update tests as well
• try to add some negative tests (adding user to non-existing group or vice versa, using duplicate names, invalid data, delete not existing resource, etc)

[gtema]

let's please use "create_user!", "create_group!" like the tests/integration/src/identity/user_group/add.rs - we should be using this pattern more since it includes automatic cleanup of the resources created by the test what helps to fix test reliability. It is actually already present in some of the added tests.

[gtema]

From now on this import is not necessary. Please remove it, but you actually should just run cargo check -p test_integration --tests to see warnings. Focus only in the files you add