IdP groups — approver cache

Cached snapshot of group memberships pulled from connected IdPs (Okta / Entra / AD / ISE / ClearPass). The notification registry expands @group:NAME entries against this cache when fanning out approval invites. Refreshed once per daemon cycle. Groups not synced in the last 24 h are flagged stale.

Trust note: the cache is read-only at notification dispatch time — the daemon refresh and the manual button above are the only paths that update it. ISE and ClearPass groups appear here without members because their REST APIs don't expose membership in a single call (per-user iteration would be expensive); use AD or Okta for human approver groups.