fix: sync device scopes on token rotation

src/infra/device-pairing.test.ts

@@ -31,6 +31,7 @@ describe("device pairing tokens", () => {
     });
     let paired = await getPairedDevice("device-1", baseDir);
     expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);
+    expect(paired?.scopes).toEqual(["operator.read"]);
 
     await rotateDeviceToken({
       deviceId: "device-1",

src/infra/device-pairing.ts

@@ -472,6 +472,9 @@ export async function rotateDeviceToken(params: {
     };
     tokens[role] = next;
     device.tokens = tokens;
+    if (params.scopes !== undefined) {
+      device.scopes = requestedScopes;
+    }
     state.pairedByDeviceId[device.deviceId] = device;
     await persistState(state, params.baseDir);
     return next;