feat(scoreboard): unit 9 — the Analytics scope, requested incrementally

Scope becomes youtube + yt-analytics.readonly, with include_granted_scopes=true so an existing
session is asked for the NEW permission only. GrantedScopes records what Google says on the token
response (both the code exchange and the refresh), and HasAnalyticsScope is the flag the scoreboard
uses to offer a one-click re-consent instead of failing anonymously mid-stream.

TokenStore is unchanged on purpose: a launch-time refresh carries the scope list, so old sessions
report 'not granted' until the creator re-consents — the honest state.

The old auth test asserted 'exactly one scope'; it now asserts the new DECISION (two scopes, no
force-ssl, analytics read-only) rather than loosening.

ytLive.Tests/YouTubeAuthServiceTests.cs

@@ -138,10 +138,17 @@ public class YouTubeAuthServiceTests
     /// documenting the guarantee gets deleted instead of obeyed.
     /// </summary>
     [Fact]
-    public void ExactlyOneScopeIsRequested_AndItIsTheBroadOne()
+    public void TwoScopesAreRequested_TheBroadYouTubeOneAndReadOnlyAnalytics()
     {
+        // Updated 2026-10-30: the scoreboard's two polled tiles need watch-time analytics, so the
+        // app asks for exactly one more scope. The DECISION worth locking is still "no redundant
+        // scopes": force-ssl stays gone, and analytics is read-only.
         Assert.Equal(
-            new[] { "https://www.googleapis.com/auth/youtube" },
+            new[]
+            {
+                "https://www.googleapis.com/auth/youtube",
+                "https://www.googleapis.com/auth/yt-analytics.readonly",
+            },
             SourceAssert.Scopes("Scope", "Services", "YouTubeAuthService.cs"));
     }