Name the permissions a token holds when Graph answers 403

[aberoham]

Graph refuses a request whose token lacks the necessary permission with 403
and, in the case that prompted this, an empty message:

{"error":{"code":"Forbidden","message":"", ...}}

So the failure said nothing about what was missing and looked like any other
authorization refusal. Working it out meant running teams auth status and
comparing the scope list against the operation by hand.

The CLI already holds that list. A 403 now names the delegated scopes the
token carries, or its application roles when the token is app-only, and points
at auth doctor and auth login:

Permission denied: Microsoft Graph returned 403 with no message
Hint: this token carries the scopes: Presence.Read.All User.Read. If the one this operation needs is not in that list, run `teams auth doctor` to see what the profile resolves to, then `teams auth login` to consent to it.

The remedy differs by token type and by tenant. A delegated scope can be
consented interactively, or through auth consent-url where the tenant
reserves consent to an administrator, and the hint names both. An application
role is granted on the app registration and consented by an administrator, so
an app-only caller is told that rather than being pointed at auth login,
which cannot add one.

This follows auth_error_message, which already appends an audience hint to a
401, and covers all three places a 403 becomes an error: error_for_status,
request_with_retry and request_with_retry_no_content.

The CLI cannot say which permission the operation needs without a mapping
from every endpoint to its scopes, which would be a table to maintain and get
wrong. Listing what the token has is the part it can know for certain.

An opaque token yields no claims and gets no hint rather than a guess.

One tradeoff worth naming: this puts the token's full permission list into an
error that may end up in a CI log or an agent transcript. It is not a
credential, and auth status already prints the same list, but it is a wider
audience than before. Hiding it behind a verbose flag was the alternative and
would defeat the purpose, since the unattended caller is the one that cannot
go and look.

Tests

Five wiremock tests: a delegated token listing its scopes, an app-only token
listing its roles and getting the administrator remedy — asserted both by what
it says and by teams auth login being absent, so that branch cannot quietly
regress — an opaque token adding nothing, and one test per remaining call site,
a no-content write and a byte download. Reverting any one of the three call
sites alone fails its own test and no other — the byte download matters
because error_for_status is reached by post_for_location and get_bytes,
not by a paginated read, which routes through request_with_retry like any
other GET.

Fixes #80

🤖 Generated with Claude Code

https://claude.ai/code/session_01C736oc7CeNtRZmAJrXm8sG