Fix resolve not sticking: heal stale UserPermission IDs and stop scroll jump

- After push_to_keycloak membership resolve, update any UserPermission
  rows with stale keycloak_user_id to match the user's current KC ID.
  This was the root cause: resolve added user to KC by their current ID,
  but the discrepancy scan still saw the old ID in UserPermission.
- Remove removeQueries/invalidateQueries from resolve hooks — wiping the
  cache caused the UI to unmount to "Not yet scanned" and re-mount,
  jumping to the top. The component's refetch() already handles refresh.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/hooks/use-keycloak-sync.ts

@@ -104,17 +104,11 @@ export function useKeycloakDiscrepancies() {
 }
 
 export function useResolveDiscrepancy() {
-  const queryClient = useQueryClient();
   return useMutation<unknown, unknown, ResolveRequest>({
     mutationFn: async (params) => {
       const { data } = await api.post("/settings/keycloak-resolve", params);
       return data;
     },
-    onSuccess: () => {
-      queryClient.removeQueries({
-        queryKey: ["settings", "keycloak-discrepancies"],
-      });
-    },
   });
 }
 
@@ -140,16 +134,10 @@ export function useSyncKeycloakUsers() {
 }
 
 export function useResolveAllDiscrepancies() {
-  const queryClient = useQueryClient();
   return useMutation<ResolveAllResponse, unknown, ResolveAllRequest>({
     mutationFn: async (params) => {
       const { data } = await api.post("/settings/keycloak-resolve-all", params);
       return data;
     },
-    onSuccess: () => {
-      queryClient.removeQueries({
-        queryKey: ["settings", "keycloak-discrepancies"],
-      });
-    },
   });
 }