fix(fhir): stop advertising a credential no client can obtain

The capability descriptor named `fhir:read` as the scope a narrow token needs
for the REST face. No code path mints a token carrying it — every mint grants a
wildcard, the medication ingest scope, or an MCP scope — so the face is
reachable by the owner's cookie session or a wildcard device token and by
nothing else. Advertising an unobtainable credential invites a client to go
looking for one. The constant stays where it belongs, as the fail-closed check
each route makes; the descriptor now reports the fact instead.

End-to-end coverage for the scope picker: the first run opens it expanded with
the fenced tier rendered and no group control over it, a group row clears the
44 px floor at 390 px, and a leaf grid opens from its chevron. All on stable
test ids rather than text a breakpoint can hide.

docs/api/openapi.yaml

@@ -15737,9 +15737,10 @@ components:
             restBaseUrl:
               type: string
               description: Base path of the read-only FHIR R4 REST face.
-            readScope:
-              type: string
-              description: Bearer scope a narrow token needs to read the FHIR face.
+            scopeMintable:
+              type: boolean
+              description: "Whether a narrow Bearer token for the FHIR face can be obtained. Always false: no mint path grants the
+                scope, so the face is reachable by the owner's cookie session or a wildcard device token only."
             resourceTypes:
               type: array
               items:
@@ -15760,7 +15761,7 @@ components:
             - snomedRoute
             - germanAtcDefaultLocales
             - restBaseUrl
-            - readScope
+            - scopeMintable
             - resourceTypes
             - operations
             - searchParams