test(auth): assert userinfo tokens have empty scopes (contract guard)

Address claude-review round 10 (Option B): pin the empty-scope contract for
userinfo-validated tokens in test_mgmt_opaque_userinfo_fallback_accepted_despite_allowlist,
so a future @require_scopes on a management endpoint that would silently reject
cross-client callers is caught by a test rather than only the docstring.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_unified_verifier.py

@@ -704,6 +704,9 @@ class TestUserinfoFallback:
         assert result is not None
         assert result.resource == "testuser"
         assert result.client_id == ""  # userinfo provides no client_id
+        # Contract: userinfo tokens carry empty scopes — management endpoints
+        # must not gate on scopes for this path (per-user authz is the gate).
+        assert result.scopes == []
 
     async def test_introspection_cannot_forge_userinfo_bypass(
         self, monkeypatch, userinfo_settings