fix(oauth): fix invalid_scope and invalid_token errors for user OAuth clients

Three bugs fixed for social-login users connecting Claude.ai via OAuth:

1. User OAuth clients now allow 'admin' scope by default — previously
   defaulted to ['read', 'write'], causing invalid_scope when Claude.ai
   requests 'admin' scope during authorization.

2. Fix JWT tokens with 'aud' claim being rejected by middleware — when
   Claude.ai sends RFC 8707 resource parameter, the issued JWT gets an
   aud claim. validate_access_token() now sets verify_aud=False to
   prevent PyJWT InvalidAudienceError from silently marking valid tokens
   as invalid in _is_valid_token().

3. Fix NameError in user_mcp_handler tools/call scope check — key_info
   was only defined in the mhu_ auth path but referenced in tools/call
   for both paths. Replaced with key_scopes variable set by both mhu_
   and JWT auth paths.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/dashboard/routes.py

@@ -2946,7 +2946,7 @@ async def dashboard_user_oauth_clients_create(request: Request) -> Response:
 
     client_name = body.get("client_name", "").strip()
     redirect_uris_raw = body.get("redirect_uris", "")
-    scopes = body.get("scopes", ["read", "write"])
+    scopes = body.get("scopes", ["read", "write", "admin"])
 
     if not client_name:
         return JSONResponse({"error": "Client name required"}, status_code=400)