fix: accept offline_access OAuth scope for MCP refresh clients

[rohanpatel2002]

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

The OAuth 2.1 authorization server already issues refresh tokens on the authorization-code grant and supports the refresh_token grant. However, offline_access is not in the supported scope allowlist (SupportedOAuthScopes), so:

1. GET /oauth/authorize?...&scope=openid%20offline_access fails with error=invalid_request / unsupported scope: offline_access
2. /.well-known/oauth-authorization-server advertises scopes_supported: ["openid","profile","email","phone"] without offline_access

MCP clients (Copilot Studio, ChatGPT, and similar) often require offline_access to be advertised and granted before they will use refresh tokens. Without it, they hold unused refresh tokens, access tokens expire after ~1 hour, and users are forced to re-authenticate.

Fixes #2628

What is the new behavior?

offline_access is added to SupportedOAuthScopes (accept-and-ignore). Because authorize validation and discovery metadata both use that shared list:

• Authorize requests that include offline_access succeed
• Discovery metadata includes offline_access in scopes_supported

No change to token issuance: refresh tokens were already issued unconditionally when configured.

Additional context

Single-source change in internal/models/oauth_scope.go, with a unit test asserting IsSupportedScope("offline_access"). Happy to adjust if maintainers prefer a different approach. Thank you for reviewing.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.