Introduce first-class scoped OAuth consent storage

The current g_user_approval row represents blanket approval and derives consent from the client’s current scopes. That means adding a client scope can effectively enlarge an existing consent.

Start by tracing the g_user_approval row and the code that derives consent from a client’s current scopes. Determine where approved scopes are stored and how client-scope changes affect existing approvals. Done means consent is stored per scope and adding a client scope does not enlarge an existing approval.

Written by the indexing model from the issue text.