Admin UI: proxy client Allowed scopes + mixed-case scope support #171

User request

For proxy-mode OAuth clients, the admin UI currently hides the Allowed scopes editor. However, /oidc/authorize still validates requested scopes against client.allowedScopes, so proxy clients cannot add provider-specific scopes (e.g., LinkedIn scopes) and authorization fails with:

Client does not allow scopes: ...

Specification (research)

Root cause

• Client detail page (src/app/admin/clients/[clientId]/page.tsx) renders the scopes card only when client.oauthClientMode === "regular".
• Backend updates already support proxy clients:
  • updateClientScopesAction and updateClientAllowedScopes() have no oauthClientMode restriction.

Proposed fix (minimal)

• Render the Allowed scopes card for both regular and proxy clients on the client detail page.
• Update proxy-mode helper copy to avoid implying scopes can’t be configured.

Tests

• Update src/app/admin/clients/__tests__/client-detail.proxy.test.tsx to assert client-scopes-card is present for proxy clients.

Acceptance criteria

1. Proxy client detail page shows the Allowed scopes card.
2. Admin can add + save provider scopes (e.g., LinkedIn scopes) and they persist after refresh.
3. /oidc/authorize accepts scopes that are a subset of configured allowed scopes and continues to reject disallowed scopes (existing behavior).
4. Other local-only settings remain hidden in proxy mode (unchanged).