feat(auth): add per-call OAuth scope checks

Let each tool define fixed-token visibility and return the exact scopes for an
OAuth challenge based on the current call.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 26e41558-43f9-42b2-8569-8489957c2b0a