#4385 Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

A swamp serve started on an empty store has to look up every name in --admins and --allowed-users again, and GET /api/auth/resolve-user only accepts a collective token holding oauth:manage. So the key a recreated instance runs with cannot be cut down to serve:*, even when it was given its OAuth client through --oauth-client-id and a supplied secret and never registers.

That same scope can register clients and delete any of the collective's OAuth clients, including one in use with force=true, so every pod carries a key far stronger than the lookup needs. The check protects little: any signed-in session, including a personal key, can already call the route.

History: the scope arrived with collective token support for serve, when the runtime key always held it for registration. swamp-club#4264 made registration a separate one-off step (swamp auth oauth-client register), which leaves the lookup as the only reason the runtime key still needs it. swamp-club#3435 reported the same 403 and improved the message without changing the requirement.

Reproduced on swamp v20261103.225037.0-sha.5911dc9c against a stub provider that copies the route's 403: a serve:* key with --admins dmc refuses to start with 403 Forbidden naming oauth:manage; with both scopes the lookup succeeds and serve starts. --admins user: _{is no workaround, because the prefix is stripped and the sub is looked up as a username. Not yet run against the real club.}

Change: routes/api/auth/resolve-user.ts accepts serve:* as well as oauth:manage, with tests and the scope rows in reference/api-key-authentication.md updated. Decide whether to drop role from the response for token callers, since swamp reads only sub and serve:* keys would otherwise see who is staff. Works for released binaries as soon as it deploys.

Follow-ups: the runbook from swamp-club#4366 moves to a runtime key with serve:* only and a separate oauth:manage key for registering. A later swamp PR updates the refused-lookup error text and design/enablers/access-control.md, which name only oauth:manage.