Function scopes_satisfy 

pub fn scopes_satisfy(token_scopes: &[String], required: &str) -> bool

Returns true if token_scopes satisfy required. Write scope satisfies read (write includes read). Single source of truth - called from both REST and MCP enforcement paths.