[Meta]: Scoped app passwords: limit a token to selected apps

Goal Let users create app passwords that only reach part of their account (Files, Calendar, Contacts, or single apps), for scripts and integrations. Model • A token's access is stored as a scopes list on the token: files:read|write|share, calendar:read|write, contacts:read|write • No scopes key = All access, same as today. Login flow tokens (desktop, mobile) and existing tokens stay there • Scopes only narrow. Admin rights are never used by a scoped token; admin work keeps using All access • Denying an app cuts its routes and DAV collections. Listeners and storage wrappers always run, so antivirus, access control, audit and activity still apply • Default deny: new routes and DAV collections are closed to scoped tokens unless a scope opens them • Malformed scopes fail closed (scoped to nothing) Enforcement • index.php and OCS: middleware after SecurityMiddleware, route table by route name • DAV: Sabre plugin on every DAV endpoint, …