Roles, part 3c: a token a member mints carries scopes only over that member's own repositories and apps #2386

Part of #2303.

Done looks like:

• [ ] Token minting (API and page) refuses a member any scope wider than their own repositories and apps, with a plain error. An admin's minting is unchanged.
• [ ] Tests: a member's token for their own repository works; a wider request is refused; the member's token cannot reach another account's repository.

Parked by the crew: the check failed ("branches on a native repo > a reader who cannot write is refused, and a stranger sees nothing") and the decider saw no point in another try (pull #2401 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("branches on a native repo > a reader who cannot write is refused, and a stranger sees nothing") and the decider saw no point in another try (pull #2405 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("branches on a native repo > a reader who cannot write is refused, and a stranger sees nothing") and the decider saw no point in another try (pull #2401 closed)
2. the check failed ("branches on a native repo > a reader who cannot write is refused, and a stranger sees nothing") and the decider saw no point in another try (pull #2405 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

replaced by #2409. Scopes are global (ro/rw/admin), and an rw token already reaches only what its holder may write. Both tries narrowed the member's rw token, so bob in test/branches.test.ts got no token and the test broke. What is left of the ask is that a member cannot mint an admin token, and #2409 says exactly that.