refactor: change OAuth scope separator from colon to dot for IDP compatibility

Many identity providers (AWS Cognito, Okta, Azure AD) reject or mishandle
colons in OAuth scope names. This migrates all custom scopes from
`resource:action` to `resource.action` format (e.g., `notes:read` →
`notes.read`), which is universally accepted and aligns with industry
conventions (Microsoft, Google).

Includes Alembic migration 004 for stored scope strings and ADR-024
documenting the rationale and RFC references.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/server/login_flow/test_dcr_lifecycle.py

@@ -37,7 +37,7 @@ async def get_oauth_token_with_client(
     authorization_endpoint: str,
     callback_url: str,
     auth_states: dict,
-    scopes: str = "openid profile email notes:read notes:write",
+    scopes: str = "openid profile email notes.read notes.write",
 ) -> str:
     """
     Helper to obtain OAuth access token using existing client credentials.
@@ -187,7 +187,7 @@ async def test_dcr_register_and_delete_lifecycle(
         "token_endpoint_auth_method": "client_secret_post",
         "grant_types": ["authorization_code", "refresh_token"],
         "response_types": ["code"],
-        "scope": "openid profile email notes:read",
+        "scope": "openid profile email notes.read",
         "token_type": "Bearer",
     }
 
@@ -209,7 +209,7 @@ async def test_dcr_register_and_delete_lifecycle(
         registration_endpoint=registration_endpoint,
         client_name="DCR Lifecycle Test Client 2",
         redirect_uris=[callback_url],
-        scopes="openid profile email notes:read",
+        scopes="openid profile email notes.read",
         token_type="Bearer",
     )
 
@@ -235,7 +235,7 @@ async def test_dcr_register_and_delete_lifecycle(
         authorization_endpoint=authorization_endpoint,
         callback_url=callback_url,
         auth_states=auth_states,
-        scopes="openid profile email notes:read",
+        scopes="openid profile email notes.read",
     )
 
     assert access_token, "Failed to obtain access token"