feat(oauth): add comprehensive scope validation and client type support
Implements full ATProto OAuth scope parsing and validation per the specification.
- Static scopes: `atproto`, `transition:generic`, `transition:chat.bsky`
- Account scope: `account:<action>` (read, write)
- Identity scope: `identity:<action>` (read, write)
- Repo scope: `repo:<nsid>:<action>` with optional DID prefix
- Blob scope: `blob:<action>` (read, write)
- RPC scope: `rpc:<nsid>:<action>` (call)
- Include scope: `include:<scope>` for extending base scopes
- Scope format validation at parse time
- Scope containment validation (requested scopes must be subset of granted)
- Server startup validation of OAUTH_SUPPORTED_SCOPES env var
- Integration at all OAuth endpoints:
- Client registration: validates requested scopes
- Authorization: validates against client's registered scopes
- Token refresh: validates scope downgrade requests
- Server metadata now returns configured scopes from OAUTH_SUPPORTED_SCOPES
- Client metadata includes registered scopes per client
- Confidential clients require client_secret for token requests
- Public clients must not send client_secret
- Proper error messages for authentication failures
- Client type dropdown (Public/Confidential) in registration form
- Dynamic helper text explaining each type
- Client type displayed in client card view
- Comprehensive parser tests for all scope types
- Scope validation integration tests
- Client secret validation tests
- Metadata scope tests
- Authorization and token endpoint tests