Persist OAuth project scope

[masnwilliams]

summary

• persist authoritative organization/project scope returned by the OAuth server
• preserve scope across automatic refresh and treat legacy credentials as organization-wide
• show the active OAuth scope in kernel auth
• document organization-wide and project-scoped login behavior

tests

• go test ./...
• go vet ./...
• go build ./...

dependency

Pairs with kernel/kernel-mcp-server#138. The fields are optional, so this remains compatible with the currently deployed OAuth server.

---

Note

Medium Risk
Touches credential storage and token refresh for all OAuth users; scope mistakes could limit API access until re-login, but fields are optional and backward compatible with older auth servers.

Overview
Adds organization-wide vs project-scoped OAuth to stored credentials: access_scope and project_id are saved on TokenStorage, filled from OAuth callback state and overridden by the token endpoint on code exchange and refresh.

Login and refresh behavior: Missing scope defaults to organization-wide; org scope clears project_id. Legacy refresh responses without scope fields keep organization-wide access. kernel auth prints the active scope (project ID or organization-wide).

README updates describe choosing scope at login, scope retention until re-login, and that project-scoped tokens cannot use --project to switch projects.

^{Reviewed by Cursor Bugbot for commit e7aa285. Bugbot is set up for automated code reviews on this repo. Configure here.}