feat: add versioned application principal scopes

[windischb]

Summary

• derive each Application's Principal scope from active Group.BoundTo roots and their transitive members across Person, Position, Service Account, and Group
• expose a versioned full-read endpoint protected by app-scope:read, with bearer callers restricted to their OAuth client's explicit AppIds
• keep scope-definition versions stable across ordinary member/profile changes while changing them for roots, nested group structure, and automatic-membership predicates
• sync Position changes through automatic group membership and document the general consumer contract
• mark groups without roles as "No permissions" in the admin UI without storing another flag

Verification

• dotnet build Modgud.slnx --no-restore
• dotnet build Modgud.Api.Tests/Modgud.Api.Tests.csproj --no-restore
• targeted scope and auto-membership unit tests: 36 passed
• vue-tsc --build
• vite build
• git diff --check