fix: mirror backend capability checks in scope save guards

[isaacraja]

Problem

Users holding only scoped config capabilities (e.g. the group-manager role with assign:configs:group + manage:configs:balance) are blocked in the panel when saving a group's config with:

Insufficient permissions: requires one of assign:configs, manage:configs

The LibreChat backend would accept their requests — the panel's server-function guards are stricter than the API they front.

Root cause

Every scope-profile mutation in src/server/scopes.ts gated on the broad caps only:

await requireAnyCapability([SystemCapabilities.ASSIGN_CONFIGS, SystemCapabilities.MANAGE_CONFIGS]);

The backend (packages/api/src/admin/config.ts in LibreChat) is more permissive:

• Whole-doc lifecycle (PUT upsert, toggle, delete): broad manage:configs OR broad assign:configs OR target-scoped assign:configs:
• Field ops (PATCH /fields, DELETE /fields?fieldPath=, POST /fields/tombstone): broad manage:configs OR per-section manage:configs:
  — assign caps do not gate field ops

Scoped capabilities never imply broad ones (the implication graph only holds manage→read pairs), so the guard always threw.

Fix

Mirror the backend exactly:

• createScopeFn / toggleScopeActiveFn / deleteScopeFn (whole-doc ops): requireAnyCapability([MANAGE_CONFIGS, ASSIGN_CONFIGS, "assign:configs:"])
• saveFieldProfileValueFn / bulkSaveProfileValuesFn / removeFieldProfileValueFn / tombstoneFieldProfileValueFn (field ops): requireAllSectionCapabilities(sections) — the existing helper that short-circuits on broad manage:configs and otherwise requires manage:configs:
  per section

Also moved the isInterfacePermissionPath early-return before the guard in saveFieldProfileValueFn / bulkSaveProfileValuesFn so interface paths never trip a section check (matches saveBaseConfigFn's existing filter-then-guard order).

Testing

• CI (vitest)
• Manually verified against the backend checks: a principal with assign:configs:group + manage:configs:balance can now create/toggle/delete group scopes and save balance-section fields; non-balance field patches still fail at the backend with "Insufficient permissions for config section:
  " (unchanged backend behavior).