feat: add fern-admin scope to allow client credentials admin rights

[cwrm56]

Summary by cubic

Adds support for admin and manager scopes for service accounts using client credentials, with fallback to fern-read when user info isn’t available. Also switches projectId auto-generation to UUIDs.

• New Features
  • Check admin scopes first in RequireAuth, then manager, then fern-read.
  • Read admin/manager scopes from config and fetch token scopes via introspection.
  • Allow RequireAdmin with admin-scoped tokens; set service-account user with proper role and is_service_account=true.
  • Auto-generate UUID projectId in createProject; updated tests.

^{Written for commit 55423be. Summary will update automatically on new commits.}

[cubic-dev-ai]

No issues found across 2 files

[cubic-dev-ai]

2 issues found across 1 file (reviewed changes from recent commits).

Prompt for AI agents (all 2 issues)

Understand the root cause of the following 2 issues and fix them.


<file name="deployments/fern-platform-kubevela.yaml">

<violation number="1" location="deployments/fern-platform-kubevela.yaml:766">
The image was changed to docker.io/library/fern-platform:latest even though the build only exists under ghcr.io/guidewire-oss or docker.io/guidewireoss; pointing at the library namespace makes the deployment fail because that image does not exist.</violation>

<violation number="2" location="deployments/fern-platform-kubevela.yaml:767">
Setting imagePullPolicy to Never prevents Kubernetes from pulling the remote fern-platform image, causing pods on fresh nodes to fail with ImagePullBackOff. Use Always or IfNotPresent for registry-hosted images.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}