Align OAuth mint with official Grok Build 0.2.101.

- UA xai-grok-build/0.2.101 + x-grok-client-version/surface
- Ephemeral loopback redirect_uri for authorize/consent/token
- Drop grok-cli:access from scope to match discovery

oidc_mint/oauth_device.py

@@ -20,7 +20,11 @@ CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828"
 ISSUER = "https://auth.x.ai"
 DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code"
 TOKEN_URL = "https://auth.x.ai/oauth2/token"
-SCOPE = "openid profile email offline_access grok-cli:access api:access"
+# 对齐官方 0.2.101 discovery / docs（去掉二进制中已不出现的 grok-cli:access）
+SCOPE = (
+    "openid profile email offline_access "
+    "api:access conversations:read conversations:write"
+)
 
 LogFn = Callable[[str], None]