fix(oauth): request the scopes the extension and CLI actually need

[EhabY]

Fixes VSC-24

Split out of #1128, which holds the live-server scope suite and is stacked on this PR.

Problem

Servers that enforce OAuth scopes (from 2.38) refuse the extension right after sign-in: GET /users/me needs user:read. An audit against a live server (#1128) found more gaps with the same cause:

• Resolving a workspace by owner/name needs user:read. Without it, remote SSH, ping, speedtest, support bundle, coder start and coder update break.
• Start builds need user:read (owner lookup), and stop builds need workspace:stop.
• Workspaces shared by another user need organization_member:read, which only the coder:workspaces.* composites grant.
• coder start dry-runs a build when a workspace must update first (workspace:create).
• Inbox notifications need inbox_notification:read (fix: let scoped tokens list and mark inbox notifications read coder#30176).

Fix

The extension requests:

coder:workspaces.operate coder:workspaces.access workspace:create user:read user:read_personal

• inbox_notification:read is requested only when the server lists it in scopes_supported (IF_SUPPORTED_OAUTH_SCOPES). Servers reject the whole request over an unknown scope, and release/2.38 doesn't offer it yet. Stored sessions don't need it.
• When the server returns no scope, the extension stores coder:all. Only servers that ignore scopes do that, and they grant everything, so later scope changes don't sign their users out. Only hasRequiredScopes reads it; it is never sent to the server.
• Logout revokes tokens even when they lack a required scope, since they still work on the server. getStoredTokens no longer checks scopes; getTokensWithRequiredScopes does, and every caller except revokeTokens uses it.

Everyone signed in with OAuth signs in again once, because their stored sessions lack the new scopes. The CHANGELOG says so.

Size

+113/−35 in 9 files:

• src/oauth: +49/−27.
• Unit tests: +58/−8.
• CHANGELOG: +6.

Tests

Unit tests cover:

• requesting IF_SUPPORTED_OAUTH_SCOPES only when the server supports them
• accepting stored sessions granted coder:all
• revoking tokens with outdated scopes
• storing coder:all when the server returns no scope

#1128 runs every request against a live server.

---

🤖 Generated with Claude Code

[linear-code]

VSC-24

[code-asher]

Tested it out, looks good!

[code-asher]

Ah one thing I realized, if the scopes change, we make them log in again, but I think we are not revoking the old token with the old scopes when this happens? Because the code treats it more like the token never existed at all rather than a logout/login. We probably should revoke the old token?

Also isLoggedInWithOauth would return false when the scopes change even though technically they are logged in with oauth, just with old scopes. It might be OK in practice since all that means is we would stop trying to refresh it which is fine since it lacks the scopes we want anyway, but it does seem to make the function name technically a lie. But it might also tie in with the previous paragraph.