fix: allow CLI file tokens for RPC access

- Accept files-scoped bearer tokens on servicelink RPC calls.
- Keep mesh shared-secret auth for trusted internal callers.
- Validate CLI auth scopes and reject unsupported values early.
- Stop CLI browser login waiting for the full timeout after callback.
- Add tests for scope normalization, RPC access, and login callback timing.

tests/test_nanoshare_cli.py

@@ -1,10 +1,13 @@
 import json
 import sys
+import threading
+import urllib.request
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'cli'))
 
 from nanoshare_client import cli
+from nanoshare_client.auth import _CallbackServer
 
 class FakeClient:
   def __init__(self):
@@ -52,6 +55,23 @@ def test_sync_uploads_new_local_file_and_writes_state(tmp_path, monkeypatch):
   state = json.loads((tmp_path / '.nanoshare-sync' / 'state.json').read_text())
   assert state['files']['hello.txt']['file_id'] == 'file_1'
 
+def test_login_callback_returns_without_waiting_for_timeout():
+  server = _CallbackServer('127.0.0.1', 0, 'expected-state')
+  result = {}
+
+  def wait_for_code():
+    result['code'] = server.wait_for_code(30)
+
+  thread = threading.Thread(target=wait_for_code)
+  thread.start()
+  with urllib.request.urlopen(f'{server.url}?code=login-code&state=expected-state', timeout=5) as response:
+    assert response.status == 200
+    assert b'login complete' in response.read()
+  thread.join(5)
+
+  assert not thread.is_alive()
+  assert result['code'] == 'login-code'
+
 def test_sync_deletes_old_remote_when_local_file_changes(tmp_path, monkeypatch):
   fake = FakeClient()
   fake.remote_files = [{'file_id': 'old_file', 'file_name': 'hello.txt', 'file_size': '5 B'}]