fix: allow CLI file tokens for RPC access

- Accept files-scoped bearer tokens on servicelink RPC calls.
- Keep mesh shared-secret auth for trusted internal callers.
- Validate CLI auth scopes and reject unsupported values early.
- Stop CLI browser login waiting for the full timeout after callback.
- Add tests for scope normalization, RPC access, and login callback timing.

tests/test_api_cli_auth.py

@@ -0,0 +1,43 @@
+import importlib.util
+import sys
+import types
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+class _NoOpLimiter:
+  def limit(self, *args, **kwargs):
+    return lambda fn: fn
+
+def _load_cli_auth_module():
+  setup_stub = types.ModuleType('my_modules.app.setup')
+  setup_stub.LIMITER = _NoOpLimiter()
+  setup_stub.cache = object()
+  sys.modules['my_modules.app.setup'] = setup_stub
+
+  module_path = Path(__file__).resolve().parents[1] / 'routes' / 'api' / 'cli_auth.py'
+  spec = importlib.util.spec_from_file_location('api_cli_auth_under_test', module_path)
+  module = importlib.util.module_from_spec(spec)
+  spec.loader.exec_module(module)
+  return module
+
+def test_normalize_cli_scope_keeps_files_scope():
+  module = _load_cli_auth_module()
+
+  assert module._normalize_cli_scope('files') == 'files'
+
+def test_normalize_cli_scope_defaults_to_files():
+  module = _load_cli_auth_module()
+
+  assert module._normalize_cli_scope(None) == 'files'
+  assert module._normalize_cli_scope('') == 'files'
+
+def test_normalize_cli_scope_rejects_unsupported_scope():
+  module = _load_cli_auth_module()
+
+  try:
+    module._normalize_cli_scope('printer')
+  except ValueError as exc:
+    assert 'unsupported CLI scope' in str(exc)
+  else:
+    raise AssertionError('expected unsupported scope to raise')