OAuth tokens can now carry a user:plugins scope for plugin sync and search

What

• Token refresh now requests the user:plugins OAuth scope alongside existing scopes. If the server rejects the expanded scope request with invalid_scope, the refresh automatically retries once with the original scope set, and the outcome is tagged invalid_scope_retried on both the success telemetry and the failure event's context.
• The tengu_oauth_token_refresh_success telemetry event now records whether the user:plugins scope was requested and whether it was actually granted.
• Account plugin sync now has its own experiment flag, tengu_account_plugins_sync_enabled (default off); when enabled and either the allow_plugin_skill_search or allow_account_plugins_sync policy is set, the user:plugins scope is included in the requested scope set.
• A new gate decides whether to send a plugin/skill search request at all, based on being first-party, not essential-traffic-only, not a CCR session token, and whether the current OAuth token already carries the user:plugins scope (refreshing the token first to check). Third-party OAuth clients or tokens without a refresh token still send the request; only a stock login token missing the scope skips it.

Why This rolls out a new, narrower OAuth scope specifically for plugin-related features (account plugin sync, plugin/skill search) instead of relying on broader existing scopes, while making sure older servers that don't yet recognize the scope don't break token refresh.