#21666: fix(gateway): restrict auto-paired device scopes to safe defaults

## Summary - When a local device auto-pairs (silent=true), it receives whatever scopes it self-declared in the connect request - Any localhost process can silently obtain `operator.admin` scopes without user approval, creating a local privilege escalation vector - Fix: intersect requested scopes with a safe default set (`operator.read`, `operator.write`) when auto-pairing, so silently paired devices cannot escalate to admin privileges ## Test plan - Verify auto-paired (silent) local devices only receive scopes within the `DEFAULT_AUTO_PAIR_SCOPES` set - Verify non-silent pairing requests continue to pass through all requested scopes for user approval - Verify a localhost process requesting `operator.admin` only gets `operator.read` and `operator.write` after auto-pairing <!-- greptile_comment --> <h3>Greptile Summary</h3> Restricted auto-paired local device scopes to safe defaults (`operator.read`, `operator.write`) to prevent local privilege escalation. Previously, localhost processes could silently obtain `operator.admin` scopes without user approval during auto-pairing. - Added `DEFAULT_AUTO_PAIR_SCOPES` constant with safe scope whitelist - Scope filtering now applies when `silent=true` and `reason="not-paired"` - Non-silent (manual approval) pairing requests retain all requested scopes for user review - Excludes sensitive scopes (`operator.admin`, `operator.approvals`, `operator.pairing`) from auto-pairing <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - it's a focused security fix that properly addresses a local privilege escalation vulnerability - The implementation is minimal, surgical, and correctly addresses the security issue. The logic properly distinguishes between silent auto-pairing (restricted scopes) and manual pairing (full user approval). The safe default set excludes admin/approvals/pairing scopes as intended. No edge cases or potential issues identified. - No files require special attention _{Last reviewed commit: 0881350} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->