Desktop app requests the * wildcard OAuth scope at sign-in

[charlesvien]

Problem

The desktop app requests the * wildcard scope at sign-in, so its OAuth token can do anything the user can. It's the main remaining client still requesting *, which blocks retiring the wildcard server-side.

Context

Client-side half of retiring the * wildcard scope:

• Retire the * wildcard: chore(oauth): retire the * wildcard posthog#60342
• Umbrella, server-side scope assignment: [Tracking] Server-side scope assignment for OAuthApplications (RFC #1103) posthog#60327

History

• feat(oauth): request explicit scopes instead of * on sign-in #2647 was the original attempt. It switched OAUTH_SCOPES from ["*"] to the explicit grantable set plus llm_gateway:read and documented two server-side prerequisites: the @default union ceiling (feat(oauth): @default union scope ceilings posthog#64087, now in master) and seeding this app's prod ceilings. It was closed without shipping.
• feat(desktop): Implement loops ➿ #3411 bundled the same scope change but shipped before the US and EU app ceilings were seeded. /oauth/authorize rejects the privileged llm_gateway:read under an unseeded ceiling, so every US prod login failed with invalid_scope, and the OAUTH_SCOPE_VERSION bump force-logged-out existing sessions into the broken flow.
• fix(auth): Revert OAuth scopes to wildcard to fix prod login #3668 reverted to ["*"] (version 5) to restore login. That leaves this issue open again.

Fix plan

1. Seed the prod OAuthApplication ceilings to ["@default", "llm_gateway:read"] for the desktop app in US (HCWoE0aRFMYxIxFNTTwkOORn5LBjOt2GVDzwSw5W) and EU (AIvijgMS0dxKEmr5z6odvRd8Pkh5vts3nPTzgzU9).
2. Re-land the explicit scope list from feat(oauth): request explicit scopes instead of * on sign-in #2647/feat(desktop): Implement loops ➿ #3411 with OAUTH_SCOPE_VERSION bumped to 7 so existing installs re-authorize onto the narrower token.
3. Verify with a real sign-in against US and EU prod before release. Dev is not a valid signal: bin/ensure-local-setup seeds the local ceiling, which is why the outage wasn't caught before merge.