refactor(auth): address /code-review on the S2 split

Cleanup only, no behaviour change (ruff clean + pytest 193):
- keep the whole OAuth scope vocabulary together in app/auth.py: the bundles
  (BASE_SCOPES/READ_SCOPES/WRITE_SCOPES/_YOUTUBE_SCOPES) move back next to the
  atoms (READ_SCOPE/WRITE_SCOPE) as core; routes/auth.py imports the bundles it
  needs instead of rebuilding them from the atoms.
- compact the const groups the split generator spread out (the six rate
  limiters, the TTLs, the demo/scope constants) back into blocks.

backend/app/auth.py

@@ -22,14 +22,18 @@ def operator_contact() -> str | None:
 
 
 DEMO_GOOGLE_SUB = "__demo__"
-
 DEMO_EMAIL = "demo@siftlode.local"
-
 MAX_SESSION_ACCOUNTS = 6
 
+# OAuth scope vocabulary — the atoms + the request bundles, kept together as core. has_*_scope check
+# the atoms against a user's stored grant; the *_SCOPES bundles are what the login/callback endpoints
+# request (imported by app/routes/auth.py).
 WRITE_SCOPE = "https://www.googleapis.com/auth/youtube"
-
 READ_SCOPE = f"{WRITE_SCOPE}.readonly"
+BASE_SCOPES = "openid email profile"
+READ_SCOPES = f"{BASE_SCOPES} {READ_SCOPE}"
+WRITE_SCOPES = f"{BASE_SCOPES} {READ_SCOPE} {WRITE_SCOPE}"
+_YOUTUBE_SCOPES = frozenset({READ_SCOPE, WRITE_SCOPE})
 
 log = logging.getLogger("siftlode.auth")