What
Description: The OAuth scope in the ext_authz flow is currently hardcoded/not configurable.

• Related TODO:
  • [internal/server/authz.go:134 — TODO: Get scope from configuration or request

Acceptance Criteria:

• Allow scope to be configured per token service or per trust domain in YAML config
• Allow scope to be extracted from the incoming request (e.g., from a query parameter or header)
• Default behavior when no scope is configured