test_service_to_service_oauth.py uses nonexistent colon-syntax scopes (read:reports/write:reports)

[man4ish]

Discovered while fixing the stale-password fixture in issue #93: all 13
tests in tests/integration/test_service_to_service_oauth.py use OAuth
scopes in colon syntax — "read:reports", "write:reports" — but
omnibioai-auth's actual permission registry
(app/core/permission_names.py) only has dot-syntax resource.action
names (billing.read, usage.read, dataset.read, model.read,
runs.read, workflow.read, etc.). There is no reports resource in
the registry at all, in either syntax.

This was previously masked: every test in the file failed earlier at
setup (_register_and_login()) because the fixture password was below
the current 12-char minimum (see #93), so registration always 400'd
before ever reaching the OAuth-client-creation call where the bad scope
name would surface. Now that the password fixture is fixed, 9 of 13
tests fail with:

AssertionError: setup: create_oauth_client failed: {"detail":"Unknown service permission: read:reports"}
assert 400 == 201

Needs a decision, not just a syntax fix: there's no reports-adjacent
permission in the registry to map this to 1:1 — the closest analogues
(usage.read, billing.read) would change what these tests actually
exercise, not just correct a typo. Whoever picks this up should
determine what these tests were actually meant to verify (a real
reports permission that should exist but doesn't? or should the tests
be rewritten against an existing resource like usage/billing?) before
changing the scope names.

Currently left red on purpose (4 of the file's 13 tests pass; the 9
scope-dependent ones fail) rather than guessed at, per the fix for #93.

---

🤖 Generated with Claude Code