fix: enforce API token scope on requests

- Add apiTokenScope to App.Locals type definition
- Store token scope in event.locals during API token auth
- Block write operations (POST/PATCH/PUT/DELETE) for read-scoped tokens
- Block admin paths for non-admin-scoped tokens
- Returns 403 with descriptive error message

src/app.d.ts

@@ -18,6 +18,8 @@ declare global {
 				id: string;
 				expiresAt: Date;
 			} | null;
+			/** API token scope — set when auth is via Bearer token, null for JWT sessions */
+			apiTokenScope: 'read' | 'write' | 'admin' | null;
 		}
 
 		interface PageData {