[Feature]: Add a --scopes flag to the cli t3 auth pairing create

[Albro3459]

Before submitting

• I searched existing issues and did not find a duplicate.
• I am describing a concrete problem or use case, not just a vague idea.

Area

apps/server

Problem or use case

Creating a new pairing token from the cli doesn't allow for limiting the scopes of that session.
Essentially I don't want my remote sessions to have terminal access for security reasons.
It is possible to create a pairing token with scopes over http, but not through the cli.

Proposed solution

Add a --scopes flag to allow uses to create pairing tokens that will have limited scopes.

Why this matters

Security with remote sessions through the t3 web app.

Smallest useful scope

A --scopes flag that takes in the allowed scopes

Alternatives considered

No response

Risks or tradeoffs

No response

Examples or references

No response

Contribution

• I would be open to helping implement this.

[juliusmarminge]

Note

Grok responding on behalf of Julius.

This landed in #9785: t3 auth pairing create and the session commands now accept a repeatable --scope option, so you can mint a pairing link without terminal access. Terminal access is also split further now. #9791 added a passive terminal:read scope, separate from terminal:operate. Closing as resolved. Thanks for the request!