Move Auth0→DB user sync to event-driven (Auth0 Event Streams) instead of full Management-API sweep

[MarShaikh]

Problem

Auth0Provider.sync_users_to_db does a full Management-API sweep to mirror all Auth0 users into MDV's database. It's manual-only, makes many API calls, and is easy to forget to run — which is how a deployment ends up with an empty users table (login never writes users; only this sync does).

Proposal

Adopt Auth0 Event Streams (now GA) to keep the users table in sync in real time. Subscribe to user.created, user.updated, and user.deleted and route them to a webhook endpoint on the MDV server that upserts/deletes the corresponding row. This makes the DB self-maintaining regardless of how the user was provisioned, and removes the need to remember to run the batch sync.

Scope

• New authenticated webhook route (verify a shared secret — Event Stream/Action payloads aren't signed like Stripe/Slack).
• Handlers for created/updated/deleted → UserService.add_or_update_user / soft-delete.
• Decide how is_admin is carried (role data may need a Management-API lookup or a token/event claim — see the roles optimization issue).
• Keep the batch sync as a one-off backfill for users created before the stream was wired up.

Open questions

• Event Streams plan/cost/availability on our Auth0 tenant.
• Idempotency & ordering (handle out-of-order/duplicate deliveries).
• Local testing (webhook relay / ngrok).

References

• Event Streams GA
• Custom log streams via webhooks