[Auth] --domain all omits base:field_group:create

Summary

On lark-cli 1.0.81, auth login --domain all does not request base:field_group:create, even though the scope exists in the CLI registry and is required by the official Base Field Groups API. A second OAuth flow requesting the exact scope is required.

Environment

• lark-cli: 1.0.81
• Brand: Lark
• Identity: user

Steps to reproduce

1. Ensure the app supports/enables base:field_group:create.
2. Start a full-domain device flow:

lark-cli auth login --domain all --no-wait --json

3. Complete authorization and finish the flow with --device-code.
4. Check the Field Group scope:

lark-cli auth check --scope base:field_group:create

Actual behavior

The full-domain authorization result excludes base:field_group:create, and the scope check reports it as missing. The scope is absent from the OAuth requested list.

Running a second, explicit flow works:

lark-cli auth login --scope "base:field_group:create" --no-wait --json

After completing that flow, the result reports:

{
  "newly_granted": ["base:field_group:create"],
  "missing": []
}

and auth check returns ok: true.

Expected behavior

--domain all should include every supported scope assigned to a CLI domain, including base:field_group:create, or the CLI should explicitly document why this scope is excluded and direct users to request it separately.

Additional context

The repository registry contains base:field_group:create in internal/registry/scope_priorities.json with recommend: true, which makes its omission from --domain all especially surprising.

Related Field Groups shortcut request: #2157

Start with internal/registry/scope_priorities.json and trace how the auth login --domain all command assembles its OAuth requested scopes. Reproduce with the listed auth login and auth check commands, then verify that the full-domain result includes base:field_group:create or that the exclusion is explicitly documented.