OAuth clients no longer accept Integration scopes; default login must not request entitlement/billing scopes. Docs: pk_live_ + Key scope ads:manage.

Co-authored-by: Cursor <cursoragent@cursor.com>