fix: Bad scope parsing

frontend/src/routes/OAuthConsent.svelte

···
     margin-bottom: var(--space-2);
     cursor: pointer;
     transition: border-color var(--transition-fast);
+    overflow: hidden;
   }
 
   .scope-item:hover:not(.required) {
···
 
   .scope-info {
     flex: 1;
+    min-width: 0;
     display: flex;
     flex-direction: column;
     gap: 2px;
+    overflow: hidden;
   }
 
   .scope-name {
     font-weight: var(--font-medium);
     color: var(--text-primary);
+    word-break: break-all;
   }
 
   .scope-description {
     font-size: var(--text-sm);
     color: var(--text-secondary);
+    word-break: break-all;
   }
 
   .required-badge {

src/oauth/endpoints/authorize.rs

···
         .into_response()
 }
 
+fn is_granular_scope(s: &str) -> bool {
+    s.starts_with("repo:") || s.starts_with("repo?") || s == "repo"
+        || s.starts_with("blob:") || s.starts_with("blob?") || s == "blob"
+        || s.starts_with("rpc:") || s.starts_with("rpc?")
+        || s.starts_with("account:")
+        || s.starts_with("identity:")
+}
+
+fn is_valid_scope(s: &str) -> bool {
+    s == "atproto"
+        || s == "transition:generic"
+        || s == "transition:chat.bsky"
+        || s == "transition:email"
+        || is_granular_scope(s)
+        || s.starts_with("include:")
+}
+
 fn validate_auth_flow_state(
     flow_state: &AuthFlowState,
     require_authenticated: bool,
···
     };
 
     let requested_scopes: Vec<&str> = effective_scope_str.split_whitespace().collect();
-    let has_granular_scopes = requested_scopes.iter().any(|s| {
-        s.starts_with("repo:")
-            || s.starts_with("blob:")
-            || s.starts_with("rpc:")
-            || s.starts_with("account:")
-            || s.starts_with("identity:")
-    });
+    let has_granular_scopes = requested_scopes.iter().any(|s| is_granular_scope(s));
     let user_denied_some_granular = has_granular_scopes
         && requested_scopes
             .iter()
-            .filter(|s| {
-                s.starts_with("repo:")
-                    || s.starts_with("blob:")
-                    || s.starts_with("rpc:")
-                    || s.starts_with("account:")
-                    || s.starts_with("identity:")
-            })
+            .filter(|s| is_granular_scope(s))
             .any(|s| !form.approved_scopes.contains(&s.to_string()));
     let atproto_was_requested = requested_scopes.contains(&"atproto");
     if atproto_was_requested
···
         );
     }
     let approved_scope_str = final_approved.join(" ");
-    let has_valid_scope = final_approved.iter().all(|s| {
-        s == "atproto"
-            || s == "transition:generic"
-            || s == "transition:chat.bsky"
-            || s == "transition:email"
-            || s.starts_with("repo:")
-            || s.starts_with("blob:")
-            || s.starts_with("rpc:")
-            || s.starts_with("account:")
-            || s.starts_with("identity:")
-            || s.starts_with("include:")
-    });
+    let has_valid_scope = final_approved.iter().all(|s| is_valid_scope(s));
     if !has_valid_scope {
         return json_error(
             StatusCode::BAD_REQUEST,