Fix OAuth scope discovery

[tiankaima]

What changed

• remove the obsolete hardcoded OAuth scope vocabulary
• derive the requested scope list from authorization-server discovery metadata
• use the same discovered scopes for client registration and browser/device authorization
• honor a reduced granted scope when deciding whether an ID token is required
• allow refresh responses to omit a new ID token, as OAuth/OIDC permits
• add regression coverage for metadata validation, registration payloads, reduced grants, and refresh

Root cause

The CLI still requested legacy scopes such as me:read and todo:read. The server now uses namespaced feature scopes such as account.profile:read and workspace.todo:read, and rejects unsupported scopes during dynamic client registration. Several legacy scopes also split into multiple current features, so a mechanical rename would remain incomplete and drift again.

The server already publishes its dynamic-registration allowlist through scopes_supported; this change makes that metadata the single scope source for the general-purpose CLI.

Impact

Both life-ustc account login and life-ustc account login --device can complete dynamic registration against the current production OAuth provider without invalid_scope failures.

Validation

• production browser-style DCR probe: HTTP 201 with discovered scopes
• production redirect-free device DCR probe: HTTP 201 with discovered scopes
• go test ./internal/auth
• go test -race ./...
• go vet ./...
• golangci-lint run ./...
• OpenAPI provenance verification and code generation
• go build -buildvcs=false -ldflags "-X github.com/Life-USTC/CLI/internal/cmd/root.version=dev" -o life-ustc ./cmd/life-ustc