The OpenID configuration lists only the scopes the forge grants, and the MCP signup tool says what the setting does #46

Problem. /.well-known/openid-configuration listed the scope admin. /oauth/authorize never grants it. The MCP signup tool said "Nothing reads it yet", but #2245 made the doors read the setting.

Root cause. The discovery documents wrote the scopes as literals, apart from the type that decides what authorize grants. The tool text was not changed with #2245.

Fix.

• OAUTH_SCOPES = ["ro", "rw"] as const in core/oauth.ts defines OAuthScope and isOAuthScope. The three discovery documents list OIDC_SCOPES and OAUTH_SCOPES from those constants, so they cannot list a scope that authorize does not grant.
• The MCP signup tool says what the setting does: open lets anyone in; invite and closed refuse a new account (invite links are not redeemed yet); the first account is never refused.

Test. test/oauth-discovery.test.ts expects scopes_supported to be exactly openid profile email ro rw. test/mcp.test.ts checks the signup tool text. On main: both fail. With the fix: both pass.

Validate (fast). Result: baseline. contain.test.ts, studio-runs.test.ts and web-origins.test.ts also fail on main 1051d451 on this box. tsc passes.

Note: if the invite PR (L1) lands, the words "invite links are not redeemed yet" must change. The PR that lands second changes them.