fix(cloudflare): add flagship:write to the OAuth scope catalog

[aryasaatvik]

The OAuth scope catalog has no Flagship entry, so OAuth-authenticated profiles can't use Cloudflare.Flagship.* resources — the first call fails:

Unauthorized: Authentication error
  at GET /accounts/{account_id}/flagship/apps

Adds flagship:write to ALL_SCOPES and DEFAULT_SCOPES. Name and description match Cloudflare's own catalog (workers-auth/src/core/scopes.ts in workers-sdk), where wrangler defaults it.

Blocked on client registration, verified: Cloudflare's authorize endpoint rejects the scope for alchemy's OAuth client:

error=invalid_scope
error_description=The OAuth 2.0 Client is not allowed to request scope 'flagship:write'.

So this needs Cloudflare to allowlist flagship:write on client 6d8c2255-0773-45f6-b376-2914632e6f91 first; until then the DEFAULT_SCOPES line would break every login. Draft until that lands — happy to split the catalog-only line out if you'd rather ship it independently.

[sam-goodwin]

Is there a flahship:read too? Or only write?

[aryasaatvik]

Only flagship:write. Cloudflare's shared OAuth catalog (workers-auth/src/core/scopes.ts in workers-sdk) has no flagship:read — same pattern as d1:write/queues:write, which are write-only scopes. Read granularity only exists in the API-token permission system ("Flagship Read" / "Flagship Edit" permission groups).

Write is also what the resources need end to end: plan only GETs, but deploy creates/updates apps and flags.

[sam-goodwin]

cc @BlankParticle