Device logins only requested OIDC scopes while the authorizer now gates API calls on v1:* scopes. Register the full scope set on the well-known prb client, request it at login via CLIClientScopes, and cover the device flow in e2e. Collapse API scopes under an accordion on the consent screen and document scope sync for future namespace additions. Signed-off-by: Ludovic Vielle <ludovic@probo.com>