identity: scope-as-set + scope narrowing on refresh (RFC 6749 §6, +6 tests)

Each access token now carries its own effective scope (<= the grant's max).
refresh/3 requests a narrower scope; the request must be a subset of the
grant scope, else {error, invalid_scope} and the refresh token is NOT
consumed (client may retry, §5.2). refresh/2 keeps full scope; scope stays
opaque (atom or list) for issue so all prior atom-scope tests are unchanged.
Also files a Blocker: PKCE S256 is blocked on erlang substrate bugs (binary
=:= always true; crypto:hash ignores binary content). token 24/24, 130/130.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.json

@@ -1,10 +1,10 @@
 {
   "language": "identity",
-  "total_pass": 124,
-  "total": 124,
+  "total_pass": 130,
+  "total": 130,
   "suites": [
     {"name":"session","pass":11,"total":11,"status":"ok"},
-    {"name":"token","pass":18,"total":18,"status":"ok"},
+    {"name":"token","pass":24,"total":24,"status":"ok"},
     {"name":"registry","pass":9,"total":9,"status":"ok"},
     {"name":"api","pass":10,"total":10,"status":"ok"},
     {"name":"oauth","pass":17,"total":17,"status":"ok"},