refactor(auth): address /code-review on the S2 split

Cleanup only, no behaviour change (ruff clean + pytest 193):
- keep the whole OAuth scope vocabulary together in app/auth.py: the bundles
  (BASE_SCOPES/READ_SCOPES/WRITE_SCOPES/_YOUTUBE_SCOPES) move back next to the
  atoms (READ_SCOPE/WRITE_SCOPE) as core; routes/auth.py imports the bundles it
  needs instead of rebuilding them from the atoms.
- compact the const groups the split generator spread out (the six rate
  limiters, the TTLs, the demo/scope constants) back into blocks.

backend/app/auth.py

@@ -22,14 +22,18 @@ def operator_contact() -> str | None:
 
 
 DEMO_GOOGLE_SUB = "__demo__"
-
 DEMO_EMAIL = "demo@siftlode.local"
-
 MAX_SESSION_ACCOUNTS = 6
 
+# OAuth scope vocabulary — the atoms + the request bundles, kept together as core. has_*_scope check
+# the atoms against a user's stored grant; the *_SCOPES bundles are what the login/callback endpoints
+# request (imported by app/routes/auth.py).
 WRITE_SCOPE = "https://www.googleapis.com/auth/youtube"
-
 READ_SCOPE = f"{WRITE_SCOPE}.readonly"
+BASE_SCOPES = "openid email profile"
+READ_SCOPES = f"{BASE_SCOPES} {READ_SCOPE}"
+WRITE_SCOPES = f"{BASE_SCOPES} {READ_SCOPE} {WRITE_SCOPE}"
+_YOUTUBE_SCOPES = frozenset({READ_SCOPE, WRITE_SCOPE})
 
 log = logging.getLogger("siftlode.auth")
 

backend/app/routes/auth.py

@@ -17,10 +17,12 @@ from sqlalchemy.orm import Session
 from app import email as email_mod
 from app import sysconfig
 from app.auth import (
+    _YOUTUBE_SCOPES,
+    BASE_SCOPES,
     MAX_SESSION_ACCOUNTS,
     PASSWORD_MIN_LEN,
-    READ_SCOPE,
-    WRITE_SCOPE,
+    READ_SCOPES,
+    WRITE_SCOPES,
     current_user,
     get_or_create_demo_user,
     google_enabled,
@@ -37,21 +39,15 @@ from app.security import encrypt, hash_password, hash_token, verify_password
 from app.utils import valid_email
 
 VERIFY_TTL = timedelta(hours=24)
-
 RESET_TTL = timedelta(hours=1)
 
 _DECOY_PASSWORD_HASH = hash_password(secrets.token_urlsafe(16))
 
 _register_limiter = RateLimiter(max_events=5, window_seconds=300)
-
 _login_limiter = RateLimiter(max_events=10, window_seconds=300)
-
 _reset_limiter = RateLimiter(max_events=5, window_seconds=300)
-
 _verify_resend_limiter = RateLimiter(max_events=5, window_seconds=300)
-
 _request_access_limiter = RateLimiter(max_events=5, window_seconds=300)
-
 _suspend_email_limiter = RateLimiter(max_events=1, window_seconds=3600)
 
 
@@ -65,14 +61,6 @@ def _notify_suspended(background: BackgroundTasks, email: str) -> None:
 
 _demo_limiter = RateLimiter(max_events=5, window_seconds=60)
 
-BASE_SCOPES = "openid email profile"
-
-READ_SCOPES = f"{BASE_SCOPES} {READ_SCOPE}"
-
-WRITE_SCOPES = f"{BASE_SCOPES} {READ_SCOPE} {WRITE_SCOPE}"
-
-_YOUTUBE_SCOPES = frozenset({READ_SCOPE, WRITE_SCOPE})
-
 router = APIRouter(prefix="/auth", tags=["auth"])
 
 _oauth = OAuth()