[service-users] docs (#33050)

## Summary & Motivation

Add docs for Service Users. Rather than adding a new page, I just made
some edits to the existing Users and Tokens pages. Also includes some
new screenshots.

## How I Tested These Changes

Existing test suite.

---------

Co-authored-by: graphite-app[bot] <96075541+graphite-app[bot]@users.noreply.github.com>

Author: smackesey

docs/docs/deployment/dagster-plus/authentication-and-access-control/rbac/users.md

@@ -25,6 +25,13 @@ In this guide, you'll learn how to manage users and their permissions using the
 - **If using Google for Single sign-on (SSO)**, users must be added in Dagster+ before they can log in.
 - **If using an Identity Provider (IdP) like Okta for SSO**, users must be assigned to the Dagster app in the IdP to be able to log in to Dagster+. Refer to the [SSO setup guides](/deployment/dagster-plus/authentication-and-access-control/sso) for setup instructions for each of our supported IdP solutions.
 
+:::note
+
+SCIM provisioning does not affect the ability to manage [service
+users](#service-users). Service users are always created and managed through the Dagster UI.
+
+:::
+
 By default, users will be granted Viewer permissions on each deployment. The default role can be adjusted by modifying the [`sso_default_role` deployment setting](/deployment/dagster-plus/deploying-code/full-deployments/full-deployment-settings-reference).
 
 ## Adding users to Dagster+
@@ -89,6 +96,39 @@ Removing a user removes them from the organization. **Note**: If using a SAML-ba
 6. Click **Remove user**.
 7. When prompted, confirm the removal.
 
+## Service users
+
+:::note
+
+Service users are a Dagster+ Pro feature.
+
+:::
+
+Service users are non-human users that can be used to authenticate API
+requests, but cannot log in to the UI or be members of a team. Service users do
+not apply to an organization's seat cap. You can create as many as you need.
+
+Service users are added, removed, and edited with the same UI as for
+regular users. If your organization has access to service users, the "Add New
+User" button above the Users table will instead be a dropdown allowing you to select
+between adding a new human user or a new service user.
+
+![Screenshot of "Add users" dropdown](/images/dagster-plus/features/authentication-and-access-control/add-users-dropdown.png)
+
+The primary identifier for a service user is its `name`, which must be unique
+within the organization. A description may also optionally be provided:
+
+![Screenshot of "Add service user" form](/images/dagster-plus/features/authentication-and-access-control/add-service-user.png)
+
+Once the service user has been created, you will be presented with the same
+permissions management UI as for human users:
+
+![Screenshot of assigning roles to a service user](/images/dagster-plus/features/authentication-and-access-control/service-user-roles.png)
+
+You will typically want to immediately create a
+[token](/deployment/dagster-plus/management/tokens/user-tokens) for a service user
+after creating it, since service users cannot do anything without a token.
+
 ## Next steps
 
 - Learn more about role-based access control (RBAC) in [Understanding User Roles & Permissions](/deployment/dagster-plus/authentication-and-access-control/rbac/user-roles-permissions)

docs/docs/deployment/dagster-plus/management/tokens/user-tokens.md

@@ -7,7 +7,7 @@ tags: [dagster-plus-feature]
 
 import ThemedImage from '@theme/ThemedImage';
 
-In this guide, we'll walk you through creating, viewing, editing, and revoking user tokens in Dagster+.
+In this guide, we'll walk you through creating, viewing, editing, and revoking user tokens in Dagster+. The below guide applies to both human users and [service users](/deployment/dagster-plus/authentication-and-access-control/rbac/users#service-users).
 
 ## Creating and revoking your own user tokens