[albanm]

Make events scope-aware: a session whose token carries a scope claim only reaches routes that check one, and gets 403 everywhere else. Sessions without a scope claim and internal secret calls are unchanged.

• Scopes: notifications:read/:write, events:read, webhooks:read/:admin, the bare family umbrellas, and the global all:read/all:write/all:admin, declared with defineScopes (lib-common-types).
• Each session route is guarded through one operation table (api/src/shared/scopes.ts) with requireScope (lib-express). Push registrations and admin routes stay refused.
• The notification and webhook-subscription websocket channels accept scoped sessions; canSubscribe still applies.
• GET /api/api-docs.json declares the scopes (fr/en) in an oauth2 scheme (oauth2SecurityScheme), each accepted scope as its own security alternative (oauth2Alternatives). It is public and does not depend on the request origin, so data-fair can merge it into the platform document.
• lib-express 1.33.0, lib-common-types 1.27.0, lib-node 2.16.1.

Why: phase 1d of the platform authorization roadmap. Scoped sessions come from the NHI token exchange today, and later from users authorizing OAuth client apps.

Heads-up:

• Webhook management is admin tier only, so all:write does not grant it.
• Dev and CI now use simple-directory:master (for the scoped NHI exchange) until a release ships it.
• events is not yet a source of data-fair's platform document; adding it is a data-fair change.