Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/oauth2scope/registry.go

@@ -72,6 +72,13 @@ func (r *Registry) Allows(tokenScopes coredata.OAuth2Scopes, action string) bool
 	return slices.ContainsFunc(grantingScopes, tokenScopes.Contains)
 }
 
+func (r *Registry) ScopesForAction(action string) []coredata.OAuth2Scope {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	return sortedScopes(r.invertedIndex[action])
+}
+
 func (r *Registry) ValidateScopes(scopes coredata.OAuth2Scopes) error {
 	r.mu.RLock()
 	defer r.mu.RUnlock()