fix: request the identity:handle OAuth scope

[tompscanlan]

The problem

Changing an AT Protocol handle fails in production. The PDS returns:

Missing required scope "identity:handle"

DEFAULT_ATPROTO_OAUTH_SCOPES in src/utils/bluesky.ts never included that
scope, so com.atproto.identity.updateHandle is refused.

Who it affects

Only users whose session comes from OAuth.

A custodial session is built from stored credentials and has full account
access, so the handle change works for them. After a user takes ownership of
their own PDS account, the same call returns a 403. Taking ownership of your
account should not cost you the ability to rename it.

This matters now because the take-ownership on-ramp is about to move a large
group of custodial users onto OAuth sessions.

The change

Two commits.

The first adds identity:handle to the default scope list, plus a unit test.
Nothing sets ATPROTO_OAUTH_SCOPES in the infrastructure repo or in any env
file, so the code default is what every environment uses. There is no config
change to make alongside this.

The second stops us reporting that scope as missing for users who cannot use
it. See below.

Existing sessions

A token does not gain a scope that is added later, so a session authorized
before this ships is measured against the new list and reported as out of
date.

That is correct for users on our PDS. They reconnect, and the handle change
starts working.

It is wrong for users on an external PDS. updateHandle rejects any identity
that is not on our PDS, so identity:handle can never be used for those
accounts. Those users would get the "New permissions are available, reconnect"
banner next to the banner that tells them account changes must be made through
their own PDS provider. Reconnecting would grant us a handle rename permission
we never use.

So the second commit measures each identity against the scopes it actually
needs, instead of one global list. getRequiredScopesForIdentity builds that
list, and both places that report a mismatch compare against it:

• /auth/me computes the mismatch live from the session token.
• The identity endpoint reads the mismatch flag stored at login.

Users on our PDS still get the banner, which is the case this scope was added
for. Users on an external PDS do not, unless they are missing a scope that
does apply to them.

Still open

We request identity:handle from everyone at authorization time, so an
external user is still asked for it on the consent screen. Narrowing the
authorization request means resolving the PDS before client.authorize, which
is a larger change. That is a separate PR, and it can call
getRequiredScopesForIdentity as well.

Testing

• 147 unit tests pass across the four affected spec files.
• I checked the new tests discriminate. With the identity:handle condition
  removed from getRequiredScopesForIdentity, eight tests fail, and all of
  them are the external PDS cases.
• eslint clean on all changed files.
• tsc --noEmit reports the same 461 errors before and after this branch. The
  diff is empty. This repo does not type check clean on main today.

Note for review

This was reported once before and closed against a change that fixed
something else, so the fix it asked for was never made. The unit test is
there to stop that happening a third time.