Allow JWTs without scopes claims

[lucarlig]

Problem

The dataplane currently rejects otherwise valid JWTs when the token has no scopes claim. ContextForge control-plane tokens do not require this claim, and the dataplane uses the token subject to load runtime config from Redis rather than using scopes for authorization today. This makes stock control-plane/admin tokens fail against dataplane MCP routes with 401 responses.

Summary

• make ContextForgeClaims.scopes optional
• preserve missing scopes as None for future policy handling
• add auth-layer regression coverage for JWTs without scopes

Validation

• cargo test -p contextforge-gateway-rs-lib layers::claims_id
• cargo test -p contextforge-gateway-rs-lib -- --test-threads=1
• cargo fmt --check
• cargo clippy -p contextforge-gateway-rs-lib --all-targets -- -D warnings