[Feature]: Add scoped permissions such as `admin:read` and `admin:write` alongside existing roles.

[Bccorb]

Problem statement

Granular roles allow for a deeper set of roles and permissions allowing for new ways to do RBAC.

Proposed solution

• Scope catalog and role-to-scope mapping are available.
• Routes can require scopes through shared middleware.
• Access tokens include scope claims.
• Existing role behavior remains backward compatible.
• Tests cover role-derived and directly assigned scopes.

Alternatives considered

No response

Impact area

Developer experience