fix: address PR review for OIDC scope prefix feature

Add offline_access to OIDC standard scopes exclusion list to prevent it
from being incorrectly prefixed, which would break Cognito refresh token
flows. Extract scope transformation into testable _transform_scopes_for_idp()
helper, add debug logging for prefixed scopes, remove unused Settings field
(oauth_routes.py consistently uses os.getenv), and add unit tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

settings.toml

@@ -37,7 +37,6 @@ oidc_issuer = "@none"
 jwks_uri = "@none"
 introspection_uri = "@none"
 userinfo_uri = "@none"
-oidc_resource_server_id = "@none"
 
 # --- Mode flags ---
 enable_multi_user_basic_auth = false