fix(connectors): the CLI's verbatim --scopes branch bypasses the available_scopes ceiling

[itomek]

Problem

cli.py:378's else branch — taken whenever --scopes is passed — sets the grant directly without calling resolve_declared_scopes, and flow.py:220-221 does not re-check either. So a scope outside the connector catalog's available_scopes flows straight into the OAuth consent screen. The Agent UI has no such hole: ui/routers/connectors.py:308-340 always resolves.

resolve_declared_scopes's own docstring (api.py:114-119) frames the ceiling as closing exactly this gap: "an agent's own declaration would flow straight into the OAuth consent screen with no check against the catalog."

Low severity — it needs local CLI access, already a high-trust position, and Google's consent screen is a second check. But it is the one path the TUI's printed remedy always takes, so it is the least-checked route in the most-followed instruction.

Acceptance criteria

• available_scopes is enforced inside start_authorization, so every caller is covered rather than just the CLI.
• Unit: a scope outside the catalog raises ScopeNotAllowedError naming it, exercised via both the CLI verbatim --scopes branch and the UI router.

Notes

Found during #2730. Deliberately not fixed there — it is pre-existing and unrelated to that issue's failure, and folding it in "while the file is open" is the drive-by the repo's scope-clean rule prohibits.