CLI authorize: "Read-only access" preset requests privileged llm_gateway:read scope, backend rejects it silently #67220

Bug Description

Authorizing the PostHog CLI (/cli/authorize?code=...&use_cases=agent-cli) with the default "Read-only access" scope preset silently fails. Clicking "Authorize CLI" appears to do nothing — no error is shown anywhere in the UI.

The network request actually fails with a 400:

{"error":"invalid_scope","error_description":"Invalid scope: llm_gateway:read"}

Root cause: the "Read-only access" preset built in frontend/src/scenes/authentication/cli/cliAuthorizeLogic.ts includes llm_gateway:read, but llm_gateway:read/llm_gateway:write are deliberately excluded from UNPRIVILEGED_SCOPES in posthog/scopes.py, and posthog/api/cli_auth.py's authorize() only allows unprivileged scopes for this flow. The backend is correctly rejecting a scope combination the frontend should never have offered — frontend/src/lib/scopes.tsx's mcp_server preset already excludes llm_gateway for the same reason, but the CLI read-only preset (and lib/scopes.tsx's own read_only_access preset) never got the same exclusion.

This makes the default "Read-only access" preset unusable for CLI authorization for every user.

Compounding issue: the failure is completely silent because submitAuthorizeFailure in cliAuthorizeLogic.ts only surfaces a few known error codes (invalid_code, expired, access_denied, invalid_project) and drops any other error, including this one, without a toast or visible field error.

How to reproduce

1. Start posthog-cli's login flow (or open /cli/authorize?code=<code>&use_cases=agent-cli directly)
2. Leave Scopes on the default "Read-only access" preset
3. Click "Authorize CLI"
4. Nothing visibly happens; devtools shows a 400 from /api/cli-auth/authorize/ with invalid_scope: llm_gateway:read

Additional context

• Fix needs two parts: exclude privileged scopes (llm_gateway) from the CLI read-only preset construction, and surface unrecognized authorize() errors to the user instead of swallowing them.

Debug info

• PostHog Cloud, region: US, commit: 4339f443870433