feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]

backend/tests/MoShiro.Backend.Tests/BackendFixture.cs

@@ -173,6 +173,11 @@ public class BackendFixture : IAsyncLifetime
         return JsonNode.Parse(text)!;
     }
 
+    /// <summary>目录里的全部能力（"all" 预设）。</summary>
+    public static JsonArray AllCapabilities() => Capabilities(CapabilityCatalog.Presets.Single(p => p.Id == "all").Capabilities.ToArray());
+
+    public static JsonArray Capabilities(params string[] ids) => [.. ids.Select(id => (JsonNode?)JsonValue.Create(id))];
+
     public static StringContent Json(JsonNode node, string mediaType = "application/json") =>
         new(node.ToJsonString(), Encoding.UTF8, mediaType);
 
@@ -237,7 +242,7 @@ public class BackendFixture : IAsyncLifetime
         JsonNode body = JsonNode.Parse(await login.Content.ReadAsStringAsync())!;
         string cookie = login.Headers.GetValues("Set-Cookie").First().Split(';')[0];
 
-        using var request = new HttpRequestMessage(HttpMethod.Post, "/api/admin/api-tokens") { Content = Json(new JsonObject { ["name"] = "tests", ["scope"] = "admin" }) };
+        using var request = new HttpRequestMessage(HttpMethod.Post, "/api/admin/api-tokens") { Content = Json(new JsonObject { ["name"] = "tests", ["capabilities"] = AllCapabilities() }) };
         request.Headers.Add("Cookie", cookie);
         request.Headers.Add("X-CSRF-Token", body["csrf_token"]!.GetValue<string>());
         using HttpResponseMessage created = await session.SendAsync(request);