[auth] Scenarios for scope selection (#36)

* wip scope change

* rm useless bool

* fix-me: package changes for linking

* negative test

* negative test for multiple scopes

* fix displays of warnings

* wip step-up

* negative test for step up auth

* move warning into main request flow

* clean up more checks

* cleanup step-up scenario

* cleanup and simplify

* cleanup middleware

* inline negative tests

* inline the other test

* refactor logging and inlining for standalone execution too

* skip pending tests

package.json

@@ -33,6 +33,7 @@
     "@types/express": "^5.0.3",
     "@types/node": "^22.10.2",
     "@typescript/native-preview": "^7.0.0-dev.20251030.1",
+    "cors": "^2.8.5",
     "eslint": "^9.8.0",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "3.6.2",