Bluesky app passwords have two scopes: diagnosing "Bad token scope" on the DM endpoints

Our bot needed to read its Bluesky DMs. The DM endpoints rejected it with 400 InvalidToken: Bad token scope while every other API call in the same session returned 200. This post is the differential d