feat: plugin-declared member token scopes (pact.HasFrontendTokenScopes)

- CompileAPITokenScopes builds the catalog from the built-ins and the
  activated plugins' declarations; a bad name, a redeclared built-in, a
  duplicate, an empty label or a missing phrase key fails boot
- POST /tokens, user:token:create and MintAPITokenFor check the
  application's own catalog (422 text unchanged); MintAPIToken keeps its
  signature with a process-wide fallback for declared scopes
- GET /_user/api/v1/tokens/scopes lists the built-ins and the declared
  scopes with translated labels
- built-in scope labels in en and pl; TestMemberTokenScopesSmoke

lang/en/lang.yaml

@@ -136,3 +136,10 @@ backend_link:
   remove_success: The frontend account is unlinked.
   unknown_user: No active frontend user has this email.
   already_linked: This administrator or this frontend user is already linked.
+api_tokens:
+  scope_read: Read
+  scope_read_description: Read your account and the data the site lets you see.
+  scope_write: Write
+  scope_write_description: Change your account and the data the site lets you edit.
+  scope_ai: AI
+  scope_ai_description: Use the site's AI features on your behalf.

lang/pl/lang.yaml

@@ -136,3 +136,10 @@ backend_link:
   remove_success: Konto na stronie zostało odłączone.
   unknown_user: Żaden aktywny użytkownik strony nie ma tego emaila.
   already_linked: Ten administrator albo ten użytkownik strony jest już połączony.
+api_tokens:
+  scope_read: Odczyt
+  scope_read_description: Odczyt Twojego konta i danych, które strona pozwala Ci oglądać.
+  scope_write: Zapis
+  scope_write_description: Zmiany na Twoim koncie i w danych, które strona pozwala Ci edytować.
+  scope_ai: AI
+  scope_ai_description: Korzystanie w Twoim imieniu z funkcji AI strony.