[BUG] claude.ai custom connector fails to request server-declared scopes for Google Workspace People API — all tool calls return permission denied

## Summary

When adding Google's official People API MCP server (`https://people.googleapis.com/mcp/v1`) as a custom connector in claude.ai, the OAuth flow **completes successfully** (the connector shows `Connected` and tools are visible in the tool list), but **every tool call fails with `The caller does not have permission`** because the access token issued by claude.ai's OAuth flow is missing the scopes the MCP server declared as required.

This is functionally the same class of bug as #42 (`offline_token` not being added as a scope during oauth), but for the People API scopes (`userinfo.profile`, `contacts.readonly`, `directory.readonly`).

## Environment

- Client: claude.ai web (custom connector UI)
- MCP server: `https://people.googleapis.com/mcp/v1` (Google official, [docs](https://developers.google.com/workspace/guides/configure-mcp-servers))
- Upstream OAuth IdP: Google (via customer-owned OAuth client in Google Cloud)
- Google Workspace customer with Domain-wide Delegation enabled; all required APIs enabled; OAuth consent screen lists `userinfo.profile`, `userinfo.email`, `contacts.readonly`, `directory.readonly`; end-user granted all requested scopes on the consent screen.

## Reproduction

1. Create an OAuth 2.0 Web Application client in Google Cloud, add `https://claude.ai/api/mcp/auth_callback` to authorized redirect URIs.
2. In claude.ai → Settings → Connectors → Add custom connector, set URL `https://people.googleapis.com/mcp/v1` and paste the OAuth client ID / secret.
3. Click Connect → redirected to Google consent screen → approve.
4. Connector status becomes `Connected`.
5. Invoke any People API tool (`get_user_profile`, `search_contacts`, `search_directory_people`).

## Expected

Tool call succeeds (or at minimum fails with a Google API error unrelated to missing OAuth scopes).

## Actual

All three tools return:

```
The caller does not have permission
```

## Root cause (as far as we could diagnose)

- The People API MCP server correctly advertises the three required scopes (`userinfo.profile`, `contacts.readonly`, `directory.readonly`) via authorization server metadata.
- The Google Cloud OAuth client is configured with these scopes on the consent screen.
- The end-user grants all scopes at the consent screen.
- **However**, claude.ai's OAuth authorization request to Google does **not** include these scopes in the `scope` parameter, so the resulting access token has only the default minimum scopes and cannot call the People API methods.

The same user / same GCP project / same OAuth client works correctly with Gmail, Drive, Calendar, and Chat custom connectors — so the issue appears specific to how claude.ai maps the server-declared required scopes to the `scope` parameter sent to the upstream IdP for the People MCP endpoint.

Note: claude.ai's custom connector UI does not expose a \"scopes\" input field, so there is no user-side workaround.

## Related

- #42 — same class of bug (hardcoded scopes in authorize request). Marked \`fix-in-progress\` but this case suggests the fix did not cover server-declared scopes for all Google Workspace MCP endpoints.

## Impact

Google's official People API MCP server is effectively unusable from claude.ai custom connectors, blocking use cases that rely on organization directory / contact lookups (e.g. personal assistant agents that resolve attendees, participants, email recipients by name).