feat: hardcode Logto org scopes in auth flow, hide from admin UI

Always include urn:logto:scope:organizations and
urn:logto:scope:organization_roles in OIDC auth requests. These are
required for role mapping in multi-tenant setups and harmless for
non-Logto providers (unknown scopes ignored per OIDC spec).

Filter them from the OIDC admin config page so they don't confuse
standalone server admins or SaaS tenants.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/pages/Admin/OidcConfigPage.tsx

@@ -23,6 +23,9 @@ interface OidcFormData {
   additionalScopes: string[];
 }
 
+// Platform-managed scopes — always requested by the auth flow, hidden from the admin UI
+const PLATFORM_SCOPES = new Set(['urn:logto:scope:organizations', 'urn:logto:scope:organization_roles']);
+
 const EMPTY_CONFIG: OidcFormData = {
   enabled: false,
   autoSignup: true,
@@ -61,7 +64,7 @@ export default function OidcConfigPage() {
         userIdClaim: data.userIdClaim ?? 'sub',
         defaultRoles: data.defaultRoles ?? ['VIEWER'],
         audience: (data as any).audience ?? '',
-        additionalScopes: (data as any).additionalScopes ?? [],
+        additionalScopes: ((data as any).additionalScopes ?? []).filter((s: string) => !PLATFORM_SCOPES.has(s)),
       }))
       .catch(() => setForm(EMPTY_CONFIG));
   }, []);