identity: scope-as-set + scope narrowing on refresh (RFC 6749 §6, +6 tests)

Each access token now carries its own effective scope (<= the grant's max).
refresh/3 requests a narrower scope; the request must be a subset of the
grant scope, else {error, invalid_scope} and the refresh token is NOT
consumed (client may retry, §5.2). refresh/2 keeps full scope; scope stays
opaque (atom or list) for issue so all prior atom-scope tests are unchanged.
Also files a Blocker: PKCE S256 is blocked on erlang substrate bugs (binary
=:= always true; crypto:hash ignores binary content). token 24/24, 130/130.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/identity/scoreboard.md

@@ -1,11 +1,11 @@
 # identity-on-sx Scoreboard
 
-**Total: 124 / 124 tests passing**
+**Total: 130 / 130 tests passing**
 
 |  | Suite | Pass | Total |
 |---|---|---|---|
 | ✅ | session | 11 | 11 |
-| ✅ | token | 18 | 18 |
+| ✅ | token | 24 | 24 |
 | ✅ | registry | 9 | 9 |
 | ✅ | api | 10 | 10 |
 | ✅ | oauth | 17 | 17 |