feat(auth): swap stub for PrismaScopeResolver + add test-tenant seed (ADR-0026 PR 2a)

PrismaScopeResolver replaces StubScopeResolver in AuthModule. Queries
user_scopes WHERE userId AND (expiresAt IS NULL OR expiresAt > NOW())
and maps each row to a typed Scope via a pure toScope helper.
Defensive: off-catalogue kinds are skipped + warn-logged rather than
thrown (write path is the canonical guard via the drift gate).

prisma/seed.ts populates Person + User + UserScope rows for the 19
test-tenant personas per notes/test-tenant-role-assignments.md. The
persona matrix (slug + email + displayName + scope tuples) is
hardcoded in the seed; tenant-private Entra oids are read from
TEST_TENANT_PERSONAS_PATH (default infra/test-tenant.personas.json,
gitignored). Idempotent on every level: User unique on entraOid,
UserScope unique on (userId, kind, value).

StubScopeResolver class stays exported from scope-resolver.ts for
spec fixtures + as a future force-everyone-unrestricted dev hint,
but is no longer wired by default.

The admin /admin/users/:id/scopes screen is split into the follow-up
PR 2b - the Angular SPA work is a different mode from this backend +
data PR.

Local: drift gate 4/24/7/3 clean, 29 drift-gate specs pass, portal-bff
lint 0 errors, 774 portal-bff specs pass (+8 for the resolver spec).

infra/test-tenant.personas.example.json

@@ -0,0 +1,22 @@
+{
+  "_README": "Per-persona Entra `oid` map for the apf-portal test tenant. Consumed by `apps/portal-bff/prisma/seed.ts` to upsert Person + User + UserScope rows for the 19 test personas. Distinct from `test-tenant.entra.json` which carries the 24 functional-role GROUP guids. Copy this file to `test-tenant.personas.json` (gitignored) and fill in the real per-user oids from the Entra portal. Keys must match the persona slugs hardcoded in `prisma/seed.ts`; missing keys cause the seed to skip that persona (logged at warn).",
+  "admin": "00000000-0000-0000-0000-000000000200",
+  "directeur-bordeaux": "00000000-0000-0000-0000-000000000201",
+  "directeur-complexe": "00000000-0000-0000-0000-000000000202",
+  "rh-aquitaine": "00000000-0000-0000-0000-000000000203",
+  "rh-siege": "00000000-0000-0000-0000-000000000204",
+  "collaborateur-simple": "00000000-0000-0000-0000-000000000205",
+  "tresorier-bordeaux": "00000000-0000-0000-0000-000000000206",
+  "dpo": "00000000-0000-0000-0000-000000000207",
+  "it": "00000000-0000-0000-0000-000000000208",
+  "benevole-aquitaine": "00000000-0000-0000-0000-000000000209",
+  "chef-equipe-bordeaux": "00000000-0000-0000-0000-00000000020a",
+  "chef-service-bordeaux": "00000000-0000-0000-0000-00000000020b",
+  "directeur-territorial-aquitaine": "00000000-0000-0000-0000-00000000020c",
+  "juriste-siege": "00000000-0000-0000-0000-00000000020d",
+  "rssi": "00000000-0000-0000-0000-00000000020e",
+  "communication-siege": "00000000-0000-0000-0000-00000000020f",
+  "elu-ca-national": "00000000-0000-0000-0000-000000000210",
+  "president-cd-aquitaine": "00000000-0000-0000-0000-000000000211",
+  "secretaire-cd-aquitaine": "00000000-0000-0000-0000-000000000212"
+}