refactor: authorize API routes with per-endpoint scopes (#1823)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

backend/internal/apperror/constructors.go

@@ -90,6 +90,11 @@ func MissingPermission() *Error {
 	return New(CodeForbidden, http.StatusForbidden, "You don't have permission to perform this action")
 }
 
+// MissingScope keeps the generic forbidden code and names the scope the caller lacks so API clients can tell what to request
+func MissingScope(scope string) *Error {
+	return MissingPermission().WithDetail("required_scope", scope)
+}
+
 func CrossOriginRequestForbidden(cause error) *Error {
 	return Wrap(cause, CodeForbidden, http.StatusForbidden, "Cross-origin requests are not allowed")
 }