Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/files/v1/handler_test.go

@@ -26,6 +26,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/securecookie"
 )
 
@@ -79,6 +80,7 @@ func TestHandleGetStaticFile(t *testing.T) {
 		nil,
 		securecookie.Config{},
 		"test-secret",
+		baseurl.MustParse("https://example.com"),
 	)
 
 	rec := httptest.NewRecorder()
@@ -118,6 +120,7 @@ func TestHandleGetFile_UnauthenticatedReturns401(t *testing.T) {
 		nil, // iamSvc — not reached when no token/cookie present
 		securecookie.Config{},
 		"test-secret",
+		baseurl.MustParse("https://example.com"),
 	)
 
 	rec := httptest.NewRecorder()