feat(auth): bootstrap token entries carry an optional scope

tests/test_auth_query_token.py

@@ -44,3 +44,16 @@ async def test_missing_everything_is_401(runtime) -> None:
     with pytest.raises(HTTPException) as exc:
         await require_token(_request(), runtime, scope="api")
     assert exc.value.status_code == 401
+
+
+async def test_bootstrap_entry_can_carry_a_scope() -> None:
+    raw = "admin:secret-a,komodo:hook-value:api"
+    store = TokenStore(
+        bootstrap=TokenStore.parse_bootstrap(raw),
+        bootstrap_scopes=TokenStore.parse_bootstrap_scopes(raw),
+    )
+    admin = await store.verify("secret-a")
+    hook = await store.verify("hook-value")
+    assert admin is not None and admin.scope == "*"
+    assert hook is not None and hook.scope == "api" and hook.name == "komodo"
+    assert not hook.allows("admin") and hook.allows("api")