[rgarcia]

Summary

kernel login no longer names OAuth scopes. It used to send scope=openid email on the authorization request and on every token refresh; both requests now omit scope.

Why

• Neither scope does anything for the CLI. It reads no ID token and no email claim; email only added a line to the consent page.
• What a login may do is decided by the person signing in, on the authorization server's consent page. A client that names no scopes leaves that decision entirely to them.
• It lets the authorization server eventually stop special-casing openid email for the CLI. Released binaries keep sending it, so the server keeps accepting it for now.

Compatibility

• The authorization server treats an absent scope as openid, which the CLI's client registration already allows, so login works against today's server unchanged.
• A refresh without scope returns a token for everything the login was granted, which is what the CLI wants.

Testing

• make test passes.
• New assertions: the authorization URL carries no scope parameter, and the refresh request carries no scope field.
• Not yet run end to end against a deployed authorization server.