fix(mcp): support declared OAuth scopes - #1607

Summary

• allow MCP OAuth auth methods to declare a non-empty scope list
• pass declared scopes into the Core OAuth policy
• preserve declared scopes through MCP UI round-trips
• keep metadata discovery unchanged when scopes are omitted

Context

Some MCP servers advertise fixed OAuth scopes but omit a protected-resource identifier from DCR. Executor then tries resource scope discovery and fails with:

Cannot discover OAuth scopes: the client has no resource configured

Declared scopes now take precedence, so scopes: ["mcp"] works without a client resource.

Related to #1330.

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• cd packages/plugins/mcp && bun run test

The full root test run also reached one unrelated parallel-only timeout in apps/host-selfhost/src/platform-credential.test.ts; that test passes in isolation.