Handle grant scope mismatches in login

Detect the Gitea different scope authorize failure as a dedicated auth
error, show the revoke URL and client ID, and retry login once after
manual grant revocation without forcing a second full authentication.

Expand the requested scope set to include read:organization, add the
revoke-grant helper path and setup auto-yes flag in the scaffold,
document the recovery flow, and cover revoke prompting and retry
behavior in forge_auth tests.

scripts/setup.sh

@@ -17,24 +17,28 @@ cd "$root"
 headless=0
 usage() {
     cat <<'USAGE'
-Usage: just setup [--headless|--no-browser]
+Usage: just setup [--headless|--no-browser] [--yes|-y]
 
 Options:
   --headless        Do not open the browser during login. Prints the
   --no-browser        authorisation URL to stderr instead; paste it into
                       any browser that can reach the loopback callback
                       port (typically via SSH port-forward, see README).
+  --yes, -y         Auto-accept every prompt (session reuse, checkout
+                    reuse) by setting FORGE_SETUP_YES=1 for this run.
+                    Safe only when FORGE_GITEA_USERNAME is already set
+                    in .env. Does not relax the --headless guard.
   -h, --help        Show this message.
 
 Environment:
-  FORGE_SETUP_YES=1 Accept every default; do not prompt. Safe only when
-                    FORGE_GITEA_USERNAME is already set in .env.
+  FORGE_SETUP_YES=1 Same as --yes; honoured even when no flag is given.
 USAGE
 }
 
 while [ $# -gt 0 ]; do
     case "$1" in
         --headless|--no-browser) headless=1; shift;;
+        --yes|-y) export FORGE_SETUP_YES=1; shift;;
         -h|--help) usage; exit 0;;
         --) shift; break;;
         -*) die "unknown option: $1 (try 'just setup --help')";;