fix(auth): include full scopes when refreshing Google OAuth token

The refresh was using reduced scopes (openid profile email) instead of the
original scopes (cloud-platform, userinfo.email, etc.). This caused Google
to return tokens with insufficient permissions, resulting in
'Request had insufficient authentication scopes' errors.

Now uses cfg.Scopes (the original OAuth scopes) when refreshing to
maintain the full permission set.

pkg/auth/oauth.go

@@ -326,11 +326,17 @@ func RefreshAccessToken(cred *AuthCredential, cfg OAuthProviderConfig) (*AuthCre
 		return nil, fmt.Errorf("no refresh token available")
 	}
 
+	// Use the same scopes as the original OAuth flow to prevent scope reduction
+	scope := cfg.Scopes
+	if scope == "" {
+		scope = "openid profile email"
+	}
+
 	data := url.Values{
 		"client_id":     {cfg.ClientID},
 		"grant_type":    {"refresh_token"},
 		"refresh_token": {cred.RefreshToken},
-		"scope":         {"openid profile email"},
+		"scope":         {scope},
 	}
 	if cfg.ClientSecret != "" {
 		data.Set("client_secret", cfg.ClientSecret)