Description

• Create fixtures and tests ensuring tokens without explicit scopes behave as['all'] with unrestricted allow-list.
• Validate old clients (expecting singlescope) still function against the server (server should still accept legacy field if present, or map to arrays server-side where practical).

Key files/areas

• Server request compatibility shims.
• Tests undercoderd/ and CLI e2e where applicable.

Acceptance criteria

• Passing tests that confirm no breakage for existing tokens and clients.