fix: allow CLI file tokens for RPC access

- Accept files-scoped bearer tokens on servicelink RPC calls.
- Keep mesh shared-secret auth for trusted internal callers.
- Validate CLI auth scopes and reject unsupported values early.
- Stop CLI browser login waiting for the full timeout after callback.
- Add tests for scope normalization, RPC access, and login callback timing.

tests/test_servicelink_link.py

@@ -56,6 +56,9 @@ class FakeConvex:
   async def get_file(self, file_id):
     return self.files.get(file_id)
 
+  async def get_files(self, user_id):
+    return list(self.files.values())
+
 def _call(envelope, token=None):
   # Call the handler the /rpc route delegates to, bypassing the LIMITER/size-cap
   # wrapper; exercises the real verify (mesh scope) + dispatch + handlers.
@@ -100,7 +103,7 @@ def test_missing_token_is_unauthorized():
   assert status == 401
   assert body['error']['code'] == 'unauthorized'
 
-def test_token_without_mesh_scope_is_forbidden():
+def test_token_with_files_scope_is_allowed():
   status, body = _call(_request('files.list'), token='nomesh')
-  assert status == 403
-  assert body['error']['code'] == 'forbidden'
+  assert status == 200
+  assert body['ok'] is True