feat(auth): sort scopes alphabetically wherever they're displayed

[srosenthal-dd]

Summary

Scopes arrive from the OAuth issuer in non-deterministic order, which makes pup's various scope-display surfaces unstable across invocations and hard to scan or diff. Sort them alphabetically at every display point.

Surfaces touched

• pup auth login pre-launch print (the 🔑 Requesting N scope(s): ... line when scope count is small enough to be inlined).
• pup auth list JSON output: each session's scopes array is now sorted.
• pup auth status JSON output: same.
• dcr::build_authorization_url: the printed authorize URL's scope= parameter is sorted too. OAuth treats scope as an unordered set so this is a no-op for the issuer; for users it makes the URL stable enough to grep or diff across runs.

A small sorted_scopes(scope_claim: &str) -> Vec<&str> helper deduplicates the parse-and-sort step shared by list and status.

Schema

The JSON output schema is unchanged (scopes stays a Vec<String> array). Only the order changes, so existing snapshot fixtures at tests/snapshots/auth_list__{human,agent}.json continue to pass.

Test plan

• cargo test --bin pup — 67 auth-related tests pass, 2 new for sorted_scopes.
• cargo clippy --bin pup --all-targets -- -D warnings clean.
• cargo fmt --check clean.
• Local E2E with synthetic sessions.json + tokens via PUP_CONFIG_DIR and DD_TOKEN_STORAGE=file: pup auth list and pup auth status both emit alphabetised arrays.