fix: use checkbox state as source of truth for OAuth scopes - #15

Summary

• The backend treated template selection and individual scope checkboxes as mutually exclusive (if/else), so selecting a template then ticking extra scopes in the advanced section would silently drop the template scopes
• Now the backend simply accepts whatever checkboxes the frontend sends — templates only preset checkboxes in the UI, the final checkbox state is the source of truth
• Removes the silent default fallback: if no scopes are selected, an empty array is sent and Cloudflare's OAuth server handles validation

Test plan

• Select "workers full" template, submit — should get all workers scopes
• Select "workers full" template, expand advanced, tick "access write", submit — should get workers scopes + access write
• Select "workers full" template, expand advanced, untick a scope, submit — should get workers scopes minus the unticked one
• Submit with no scopes selected — should be rejected by Cloudflare OAuth server