Add a governance tag to a user

Adds a key/value tag to the selected user (the "Add tag" action on the Tags tab). User tags are governance metadata — alongside derived tags such as department, employee-id, account-type, mfa and directory — and propagate to access reviews and cost-attribution reports. The created tag becomes immediately visible on the user's Tags tab and in downstream reporting dimensions. Validation: userId must exist and be visible in scopeId (404 via ErrNotFound); key is required, 1–128 characters, and must be unique among the user's tags — a duplicate key returns 409 CONFLICT; value is required and at most 256 characters; malformed keys/values return 422 VALIDATION_FAILED; the caller must hold owner|admin on the scope. Async & state: Synchronous — returns 201 with the created tag. A resource.updated SSE frame (kind iam.user, patch on tags) is emitted so open detail views and dependent reports refresh; propagation into access-review and cost-attribution read models happens eventually in the background. Errors: 401 unauthenticated; 403 when the caller lacks owner|admin on the scope; 404 when scopeId/userId is unknown; 409 when the tag key already exists on the user; 422 on key/value validation failure; 500 on write failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended) because the UI can retry; replaying the same key returns the originally created tag instead of failing on the duplicate-key conflict it would otherwise raise.