#1375 End-to-end UAT for fine-grained collective token scopes (#960)

Context

All code for #960 has shipped across both repos (swamp-club web and swamp CLI). This issue tracks end-to-end verification against the real running stack to confirm the full flow works before closing #960.

Test plan

1. Token creation (web UI)

• Navigate to /o/[slug]/settings → API Tokens
• Create a token with only extensions:push scope
• Verify the scope selector shows both Extensions and Infrastructure groups
• Verify the token appears in the list with the correct scope badge
• Verify the raw key is shown once and starts with swamp_org_

2. Token creation (CLI)

• Run swamp auth token create --collective <slug> --scopes extensions:push
• Verify the token is created and key is displayed
• Run swamp auth token create --collective <slug> --scopes extensions:push,serve:* --name ci-deploy
• Verify multi-scope token creation works with custom name
• Verify --json output is parseable and includes scopes

3. Token introspection

• Set the scoped token as SWAMP_API_KEY
• Run swamp auth whoami — verify it shows collective identity and scopes
• Verify legacyToken is NOT in the whoami output
• Verify JSON output includes scopes array

4. Scope enforcement — permitted operations

• With extensions:push scoped token, run swamp extension push — should succeed
• With extensions:* scoped token, push, promote, and search should all succeed

5. Scope enforcement — denied operations

• With extensions:push only token, attempt to promote — should get 403 with scope-specific message
• Verify the CLI surfaces the message clearly (e.g. "Token lacks required scope 'extensions:promote'")

6. Infrastructure scope enforcement

• With a token that has serve:*, run swamp serve --auth-mode token — should pass the scope check
• With a token lacking serve:*, run swamp serve --auth-mode token — should get scope error
• Same pattern for datastore:* on swamp datastore setup (external type)
• Same pattern for vault:* on swamp vault create (non-local type)

7. Legacy token backwards compatibility

• Verify any tokens created before the scopes feature still work
• Verify legacy tokens show extensions:* in whoami
• Verify legacy tokens show the "LEGACY — ROTATE" warning badge in the UI
• Verify legacy tokens pass all extension scope checks

8. Personal API key regression

• Verify swamp auth login still works and creates a personal key
• Verify personal keys can push, promote, search without scope restrictions
• Verify personal keys are completely unaffected by the scoping system

9. Edge cases

• Create a token with no scopes selected — should be blocked by the UI (button disabled)
• Call the API directly with invalid scopes — should get 422
• Call the API without scopes field — should default to extensions:*
• Revoke a scoped token — verify it stops working immediately