fix(auth): request moderator OAuth scopes only on opt-in

Stop asking for mod scopes at normal login so existing core-only tokens
never hit a missing-permissions dialog. Gate moderated-channels Helix,
offer an Enable flow for mods/broadcasters, and upgrade atomically.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/get_twitch_token.dart

@@ -31,6 +31,8 @@ void main() async {
       'client_id': clientId,
       'redirect_uri': redirectUri,
       'response_type': 'token',
+      // Core scopes only — matches normal app login. Use the in-app
+      // "Enable moderator tools" flow when moderator scopes are needed.
       'scope': twitchUserScopeQuery,
     },
   ).toString();