Directory Sync for admin/team members (separate from the frontend portal)

Description: Directory sync currently covers frontend portal users only. Admin (team member) accounts still have to be added and removed manually in the dashboard. This request is to extend directory sync to the admin area as a second, independently configured sync, not as an extension of the existing portal sync. The two user bases don't map to the same groups in an identity provider. Portal users are typically "everyone in the company," while admins are a specific subset such as HQ or a single product team. The admin sync therefore needs its own connection, its own group/filter mapping, and ideally its own role mapping (IdP group → Sleekplan admin role), rather than inheriting whatever the portal sync points at. It should be possible to run one, the other, or both. Suggested scope: a separate directory sync configuration in the team/admin settings, group-to-role mapping so provisioned admins arrive with the right permission level, automatic deprovisioning that revokes admin access when a user leaves the mapped group, and correct team seat consumption on provisioning so billing stays accurate. One open question to decide: whether a deprovisioned admin is deactivated or fully deleted, since their activity history (assignments, status changes, comments) needs to survive either way. Why it matters: Offboarding is the strongest driver. On accounts with several dozen admins, manual deprovisioning means a departing employee keeps admin access until someone remembers to remove them. That's a security and compliance concern rather than a convenience one, and it's a common question from teams evaluating SAML SSO for internal use. Organizations already syncing their portal users expect the same automation for the people actioning the feedback.