fix(coderd/oauth2provider): pin revoked-token refreshes and stop echoing a scope that names nothing - #28753

TL;DR

Last of three in PLAT-481, which closes PLAT-470. Refreshing a revoked token returned HTTP 500 until #28752 stopped reading the api_keys row ahead of deleting it. This PR pins the response a client sees on every revocation path, and stops echoing a stored scope that names nothing.

• Diff is against fix: make OAuth2 refresh token redemption single-use under concurrency #28752, not main.
• No handler change for the error class, no new sentinel, no migration, no docs: the error class is not documented behavior.

The error class (FR12, AC13, AC14)

• The fix lives in fix: make OAuth2 refresh token redemption single-use under concurrency #28752. Earlier revisions of this PR mapped sql.ErrNoRows from GetAPIKeyByID to errBadToken. Review of fix: make OAuth2 refresh token redemption single-use under concurrency #28752 pointed out that the read itself was redundant, since the token row carries both the key id and the user id, and removing it collapsed the race window instead of relabeling its error. The returning-row delete is now the first statement to touch the key and already answers invalid_grant when it finds nothing.
• The two revocation paths a client can reach both cascade the oauth2_provider_app_tokens row away, so the prefix lookup answers errBadToken first. Deleting the API key and deleting the app secret are pinned here anyway: the property a client depends on is the response, not which statement notices it, and the cascades that make them pass are schema this function does not control.
• The case that answered 500 is a token row whose api_key_id names no key. The FK cascade makes that unreachable through any API, so TestOAuth2RefreshKeyMissing disables the constraints to seed it, and takes a database of its own because disabling them applies to every table. It now reaches the delete and answers 400.
• FR12 names a third path, deleting the app. It never reaches the grant: the client_id no longer resolves, so ExtractOAuth2ProviderAppWithOAuth2Errors answers 401 invalid_client first. AppDeleted pins that, and the spec is corrected.

The scope that names nothing

• CHECK (scope <> '') admits a whitespace-only scope, and scopeStringToAPIKeyScopes echoed it into error_description as an empty pair of quotes. There is no name to report, so the rejection carries a fixed message instead.
• This PR no longer carries the error_description charset work the earlier revisions did. feat: let an OAuth2 refresh narrow the granted scope #28751 sanitizes every token-endpoint description to the RFC 6749 §5.2 set at writeTokenError, and feat: re-check the app allowlist at OAuth2 code redemption #28740 landed checkScopeStillCovered returning its sentinel bare rather than naming the app's registered scopes, so both halves are below this PR now.
• StoredScopeOutsideEnumRejectedOnRefresh covers an unmintable stored scope reached through a refresh rather than through an authorization code, which is the likelier way a name dropped from the enum surfaces: a grant outlives the code that issued it.

Stack: #28237, #28740, #28744, #28751, #28752, this PR.