fix(auth): derive scope labels from catalog names

[mattzcarey]

Summary

• derive each permission-row stem from the production OAuth scope catalog's name instead of rebuilding product names from scope IDs
• keep the existing one-row/multiple-action checkbox UI and preserve scope IDs as stable grouping/submission values
• remove the custom resource-label and acronym maps, preserving catalog casing such as MoQ
• upgrade @cloudflare/workers-oauth-provider from 0.10.2 to the latest release, 0.10.3

Compatibility checks

Production Worker version 118 currently bundles workers-oauth-provider 0.10.2. Version 0.10.3 scopes default CIMD grant revocation to the authorizing redirect URI; it does not change authorization-response issuer behavior.

I also exercised the newest ChatGPT desktop build downloaded by Sparkle (26.803.81509, Codex CLI 0.147.0-alpha.6.6) against a local RFC 9207 fixture:

• matching iss: authorization completed and the token endpoint received one request
• mismatched iss: authorization failed and the token endpoint received no request

This confirms the latest desktop client's iss validation works with the issuer response emitted by this server.

Verification

• npm run check (281 tests)