Security
- A scoped API token can no longer reach the account-management routes to escape its own scope
(GHSA-xcv5-6w6x-x5q2). The auth router is mounted ahead of the global scope, guest and module
gates so that login, first-run setup and the OIDC handshake stay reachable without a session -
but that placement also meant none of those gates ran for/api/v1/auth/*. A token restricted to
a single read scope, acting as an admin subject, could therefore create a new unscoped token or a
new admin user and so defeat the least-privilege boundary that scoping exists to provide. The
router now re-checks scope at its own entry: a scoped token (including one scoped to nothing) is
refused on every auth route, while unscoped legacy tokens and interactive sessions are unaffected.