ITAM GraphQL actions were never registered in the shared OAuth2 scope registry, so bearer-token callers failed closed even when role policies allowed them. Add v1:itam / v1:itam:read mappings, register them in probod, and sync the CLI client scopes. Signed-off-by: Ludovic Vielle <ludovic@probo.com>