Fix SCIM GET /Users error when user_email is UUID

Root cause fix:
- Set user_email=None instead of user_id when creating users without email (scim_v2.py line 313)
- Prevents UUIDs from being stored in user_email field in the first place

Defensive fix:
- Add validation in scim_transformations.py to check if user_email contains '@' before creating SCIMUserEmail
- Handles existing users in database that may have UUIDs in user_email field
- Prevents validation error when transforming users to SCIM format

Fixes issue where GET /Users returns 500 error with message:
'value is not a valid email address: An email address must have an @-sign'

litellm/proxy/management_endpoints/scim/scim_transformations.py

@@ -40,7 +40,9 @@ class ScimTransformations:
         user_updated_at = user.updated_at.isoformat() if user.updated_at else None
 
         emails = []
-        if user.user_email:
+        # Only add email if it's a valid email address (contains @)
+        # user_email can be a UUID when users are created without an email
+        if user.user_email and "@" in user.user_email:
             emails.append(SCIMUserEmail(value=user.user_email, primary=True))
 
         return SCIMUser(
@@ -126,7 +128,7 @@ class ScimTransformations:
         for member in team.members_with_roles or []:
             if isinstance(member, dict):
                 member = Member(**member)
-            
+
             scim_members.append(
                 SCIMMember(
                     value=ScimTransformations._get_scim_member_value(member),
@@ -161,7 +163,7 @@ class ScimTransformations:
         elif hasattr(member, "user_id"):
             return member.user_id or ScimTransformations.DEFAULT_SCIM_MEMBER_VALUE
         return ScimTransformations.DEFAULT_SCIM_MEMBER_VALUE
-    
+
     @staticmethod
     def _get_scim_member_display(member: Member) -> str:
         """

litellm/proxy/management_endpoints/scim/scim_v2.py

@@ -310,7 +310,7 @@ async def _create_user_if_not_exists(
 
         new_user_request = NewUserRequest(
             user_id=user_id,
-            user_email=user_id,  # We don't have email from group membership
+            user_email=None,  # We don't have email from group membership
             user_alias=None,
             teams=[],  # Teams will be added separately
             metadata={"created_via": created_via},