fix(fhir): stop advertising a credential no client can obtain

The capability descriptor named `fhir:read` as the scope a narrow token needs
for the REST face. No code path mints a token carrying it — every mint grants a
wildcard, the medication ingest scope, or an MCP scope — so the face is
reachable by the owner's cookie session or a wildcard device token and by
nothing else. Advertising an unobtainable credential invites a client to go
looking for one. The constant stays where it belongs, as the fail-closed check
each route makes; the descriptor now reports the fact instead.

End-to-end coverage for the scope picker: the first run opens it expanded with
the fenced tier rendered and no group control over it, a group row clears the
44 px floor at 390 px, and a leaf grid opens from its chevron. All on stable
test ids rather than text a breakpoint can hide.

src/lib/openapi/routes/meta.ts

@@ -70,9 +70,11 @@ const capabilitiesResponse = z
         restBaseUrl: z
           .string()
           .describe("Base path of the read-only FHIR R4 REST face."),
-        readScope: z
-          .string()
-          .describe("Bearer scope a narrow token needs to read the FHIR face."),
+        scopeMintable: z
+          .boolean()
+          .describe(
+            "Whether a narrow Bearer token for the FHIR face can be obtained. Always false: no mint path grants the scope, so the face is reachable by the owner's cookie session or a wildcard device token only.",
+          ),
         resourceTypes: z
           .array(z.string())
           .describe(