feat: request spec-aligned scopes, learn resource-indicator support, and validate iss on remote login

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C555wgLmfbVWf4oxK7FvwB

Author: daviddanialy

.changeset/issuer-scope-and-resource-strategy.md

@@ -0,0 +1,5 @@
+---
+"server": minor
+---
+
+Remote logins now request `openid`, `email`, `profile`, and `offline_access` whenever the upstream issuer advertises them, on top of the client's stored scope or the issuer's `scopes_supported`; operators can pin a verbatim request per issuer with the new `scope_override`. An issuer that rejects the RFC 8707 `resource` parameter with `invalid_target` is recorded as such (`resource_indicator_supported`) and the login is retried once without it, while the resource stays recorded on the grant. Issuers that advertise the RFC 9207 `iss` parameter have it validated on the callback, and the consent page offers a reconnect when a live grant lacks `openid` that a reconnect would now request.

.speakeasy/out.openapi.yaml

@@ -220,6 +220,14 @@ actions:
   - target: $.components.schemas.RemoteSessionIssuerDraft.properties.claims_supported
     update:
       nullable: true
+  # scope_override is an operator knob rather than a discovered capability,
+  # but null ("unset") must stay distinct from [] on the wire the same way.
+  - target: $.components.schemas.RemoteSessionIssuer.properties.scope_override
+    update:
+      nullable: true
+  - target: $.components.schemas.RemoteSessionIssuerDraft.properties.scope_override
+    update:
+      nullable: true
   - target: $.components.schemas.InfoResponseBody.required
     remove: true
   - target: $.components.schemas.InfoResponseBody