Description

• Add--scope <name> (repeatable) and--allow <resource_spec> flags tocoder tokens create.
• Displayscopes andallow_list incoder tokens list andcoder tokens view.

Key files/areas

• cli/tokens.go and related command files.

Acceptance criteria

• Manual tests demonstrate creating a narrowly scoped key via CLI and that it cannot perform out-of-scope operations.
• Help text documents examples (e.g.,--scope workspace:read --allow workspace:<uuid>).