feat: plugin-declared member token scopes (pact.HasFrontendTokenScopes)

- CompileAPITokenScopes builds the catalog from the built-ins and the
  activated plugins' declarations; a bad name, a redeclared built-in, a
  duplicate, an empty label or a missing phrase key fails boot
- POST /tokens, user:token:create and MintAPITokenFor check the
  application's own catalog (422 text unchanged); MintAPIToken keeps its
  signature with a process-wide fallback for declared scopes
- GET /_user/api/v1/tokens/scopes lists the built-ins and the declared
  scopes with translated labels
- built-in scope labels in en and pl; TestMemberTokenScopesSmoke

console/api_tokens.go

@@ -79,7 +79,7 @@ Revoke a token with user:token:revoke and list them with user:token:list.`,
 					if err != nil {
 						return err
 					}
-					secret, token, err := classes.MintAPIToken(prefix, user.ID, name, scopes, expiresAt, nil)
+					secret, token, err := classes.MintAPITokenFor(app, prefix, user.ID, name, scopes, expiresAt, nil)
 					if err != nil {
 						return fmt.Errorf("user:token:create: %w", err)
 					}