Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

apps/console/src/pages/iam/auth/ConsentPage.tsx

@@ -19,6 +19,7 @@ import {
   Button,
   IconArrowsClockwise,
   IconEnvelope,
+  IconKey,
   IconLockOpen,
   IconUser,
   IconUserCircle,
@@ -68,6 +69,14 @@ const scopeIcons: Record<string, React.ReactNode> = {
   offline_access: <IconArrowsClockwise size={18} className="shrink-0 text-txt-tertiary" />,
 };
 
+function scopeIcon(name: string): React.ReactNode {
+  return scopeIcons[name] ?? <IconKey size={18} className="shrink-0 text-txt-tertiary" />;
+}
+
+function scopeLabel(name: string): string {
+  return scopeLabels[name] ?? name;
+}
+
 export default function ConsentPage(props: {
   queryRef: PreloadedQuery<ConsentPageQuery>;
 }) {
@@ -192,16 +201,17 @@ export default function ConsentPage(props: {
       </div>
 
       <ul className="space-y-2">
-        {consent.scopes.map((scope: string) => {
-          const label = scopeLabels[scope];
-          if (!label) return null;
+        {consent.scopes.map((scope) => {
+          const label = scopeLabel(scope);
+          const translated = scopeLabels[scope] ? __(label) : label;
+
           return (
             <li
               key={scope}
               className="flex items-center gap-2.5 px-3 py-2.5 text-sm text-txt-secondary border border-border-mid rounded-lg"
             >
-              {scopeIcons[scope]}
-              {__(label)}
+              {scopeIcon(scope)}
+              {translated}
             </li>
           );
         })}