fix(dev-token): warn at mint when the token can't spend (read-only/OAuth)

[ZacxDev]

What

A dogfood of dev:live hit a silent dead-end: Generate did nothing — no network, no console, no error. Root cause: the dev token was minted from an OAuth login (civitai login), so the server stripped ai:write:budgeted. The resulting read-only token makes the live host's Generate post REQUEST_CONSENT, which live mode can't grant → silent hang.

This catches it at the source: app dev-token now decodes the minted JWT payload and, when ai:write:budgeted is absent, prints a loud, actionable stderr warning:

⚠  This token is READ-ONLY — it has no `ai:write:budgeted` scope, so `npm run dev:live`
   will NOT spend Buzz or generate (Generate dead-ends silently).
   You're authenticated with an OAuth login. Real generation needs a full-scope personal API key:
     civitai login --token <key>      # create one at https://civitai.com/user/account
     civitai app dev-token <slug> --env >> .env.development.local   # re-mint, then restart dev:live

The token still goes to stdout cleanly, so --env >> .env.development.local is unaffected.

Verification

go build ./... + go test ./internal/... green. New tests: tokenCanSpend table (budgeted / read-only / empty / malformed JWTs) + the command warns on a read-only minted JWT and stays silent on a spendable one.

Sibling fix

The runtime half is civitai/civitai-app-starters (the live host now also warns at startup + logs on REQUEST_CONSENT instead of silently swallowing it).

🤖 Generated with Claude Code