Auth Jwt Scope Create

Step-up scope change — Phase 5 of the staff step-up auth rollout.

One endpoint, both directions. Caller submits the desired session_scope value; the server validates, mints a new JWT carrying that scope, and returns it. Models OAuth 2.0 Token Exchange (RFC 8693). Replaces the originally-planned two endpoints (/scope-up/ + /scope-down/) — they were the same operation with opposite signs.

Validation gates differ by direction:

• Elevating (non-empty scope): requires reason in the body AND a fresh is_password_recently_verified flag (from the Phase 4 password-verify endpoint, 5-min sudo window).
• Narrowing (empty scope): no extra gate. Narrowing is always safe and reversible.

The OLD JWT remains cryptographically valid until its exp. Caller is responsible for replacing it client-side. Instant invalidation comes in Phase 7 (JTI denylist).

See implementation_logs/security/staff_step_up_auth_design.md §5.