Fix HubSpot optional scopes for workspace OAuth

[LloydVickeryASI]

Summary

• add HubSpot's intended optional scopes to the generated optional_scope authorize parameter for workspace-owned OAuth clients
• share the HubSpot optional-scope source with the existing first-party client configuration
• add regression coverage for HubSpot authorize URLs and token-host exclusion

Why

The first-party HubSpot client already emits optional_scope, but workspace-owned HubSpot clients only receive generic provider extras. Their generated authorization URL therefore includes required scope values while silently omitting the app's optional scopes.

HubSpot requires optional app scopes in its provider-specific optional_scope parameter so accounts without a corresponding product can still complete consent.

Test plan

• bun run --cwd packages/core/sdk test -- oauth-helpers.test.ts (78 passed)
• bun run --cwd apps/cloud test -- src/engine/first-party-oauth-clients.test.ts (6 passed)
• bun run format:check
• bun run lint
• bun run typecheck

[LloydVickeryASI]

CI note: the only failing check is cloud E2E shard 13. Its failure is in cloud/mcp-session-cap-eviction.test.ts (openSession (session-4): no mcp-session-id header); the HubSpot/OAuth tests and all other checks passed. This appears unrelated to the four changed files. I attempted to rerun the failed job, but GitHub limits upstream workflow reruns to repository admins. Could a maintainer rerun that shard?