feat(32.1-02): expand OAuth MCP scopes from the published catalog

- Publish the compiled member-token catalog as pact.MemberTokenScopeCatalog
- Imply declared names only when the MCP subject has a ClientID
- Reject a bad Implies and the reserved names backend and offline_access

plugin.go

@@ -153,7 +153,8 @@ func (p *Plugin) bootDeviceRevocation(app *backpack.App) {
 
 // bootAPITokenScopes compiles the member token scope catalog from the
 // activated plugins (pact.HasFrontendTokenScopes), checks that every phrase
-// key it names exists, and publishes it. A bad declaration fails boot.
+// key it names exists, and publishes it as *classes.APITokenScopeCatalog and
+// as pact.MemberTokenScopeCatalog. A bad declaration fails boot.
 func (p *Plugin) bootAPITokenScopes(app *backpack.App) error {
 	activated, _ := app.Lookup[party.Activated]()
 	catalog, err := classes.CompileAPITokenScopes(activated)
@@ -173,7 +174,10 @@ func (p *Plugin) bootAPITokenScopes(app *backpack.App) error {
 			}
 		}
 	}
-	return app.Publish(catalog)
+	if err := app.Publish(catalog); err != nil {
+		return err
+	}
+	return app.Publish[pact.MemberTokenScopeCatalog](catalog)
 }
 
 // bootMCPGuard registers the "user" MCP guard provider in the application's