fix(docs): stop the scope tables overstating what a self-issued token grants

Review findings from the first round, all in the generated prose rather
than the scope data.

Only some self-issued credentials have permissions to pick. An Airtable
PAT and a Slack custom bot do; a Wealthbox, Monday or Pipedrive token
carries its creating user's access with no picker at all, and a Google
service account uses domain-wide delegation over a set the JWT flow
filters. Telling every reader to "grant it the same access" sent most of
them looking for a setting that does not exist. Say instead that a
self-issued credential carries whatever access it was created with.

Slack's approval-gated scopes were invisible to a self-hoster. They stay
out of the tables so generated output cannot vary by deployment, but
anyone who sets `SLACK_EXTENDED_SCOPES` has to add them to the app first,
and Slack rejects the entire authorization when the app is not approved
for one. Both the integration page and the self-hosting reference now
name them and their flag, sourced from a new `ENV_GATED_SCOPES` entry that
`getSlackApprovalGatedScopes` also reads, so the prose cannot drift from
the grant.

`Chat.ReadWrite` and `Mail.ReadWrite` were labelled write-only. Both also
read, and these labels show on the consent screen as well as in the docs.

Also switch the scopes import in `oauth.ts` to the absolute specifier its
sibling OAuth imports use.

Author: mzxchandra

apps/docs/content/docs/integrations/airtable.mdx

@@ -41,7 +41,7 @@ Connecting Airtable requests these scopes.
 | `user.email:read` | Read email address |
 | `webhook:manage` | Manage webhooks |
 
-Airtable also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Airtable also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/asana.mdx

@@ -38,7 +38,7 @@ Connecting Asana requests these scopes.
 | ----- | ----------- |
 | `default` | Access Asana workspace |
 
-Asana also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Asana also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/attio.mdx

@@ -46,7 +46,7 @@ Connecting Attio requests these scopes.
 | `user_management:read` | View workspace members |
 | `webhook:read-write` | Manage webhooks |
 
-Attio also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Attio also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/box.mdx

@@ -48,7 +48,7 @@ Connecting Box requests these scopes.
 | `root_readwrite` | Read and write all files and folders in Box account |
 | `sign_requests.readwrite` | Create and manage Box Sign e-signature requests |
 
-Box also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Box also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/confluence.mdx

@@ -73,7 +73,7 @@ Connecting Confluence requests these scopes.
 | `write:space.property:confluence` | Create and manage space properties |
 | `read:space.permission:confluence` | View Confluence space permissions |
 
-Confluence also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Confluence also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/gmail.mdx

@@ -46,7 +46,7 @@ Connecting Gmail requests these scopes.
 | `https://www.googleapis.com/auth/gmail.modify` | View and manage email messages |
 | `https://www.googleapis.com/auth/gmail.labels` | View and manage email labels |
 
-Gmail also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Gmail also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/google_bigquery.mdx

@@ -39,7 +39,7 @@ Connecting Google BigQuery requests these scopes.
 | `https://www.googleapis.com/auth/userinfo.profile` | View basic profile info |
 | `https://www.googleapis.com/auth/bigquery` | View and manage data in Google BigQuery |
 
-Google BigQuery also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Google BigQuery also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/google_calendar.mdx

@@ -43,7 +43,7 @@ Connecting Google Calendar requests these scopes.
 | `https://www.googleapis.com/auth/userinfo.profile` | View basic profile info |
 | `https://www.googleapis.com/auth/calendar` | View and manage calendar |
 
-Google Calendar also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Google Calendar also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/google_contacts.mdx

@@ -38,7 +38,7 @@ Connecting Google Contacts requests these scopes.
 | `https://www.googleapis.com/auth/userinfo.profile` | View basic profile info |
 | `https://www.googleapis.com/auth/contacts` | View and manage Google Contacts |
 
-Google Contacts also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Google Contacts also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions

apps/docs/content/docs/integrations/google_docs.mdx

@@ -41,7 +41,7 @@ Connecting Google Docs requests these scopes.
 | `https://www.googleapis.com/auth/drive.file` | View and manage Google Drive files |
 | `https://www.googleapis.com/auth/drive` | Access all Google Drive files |
 
-Google Docs also accepts a credential you create yourself. Grant it the same access, since Sim can only request scopes on a connection it opens.
+Google Docs also accepts a credential you create yourself. Sim cannot request scopes on one, so its access is whatever the credential carries: some providers let you select these permissions when you create the token, others give it the creating user's access.
 
 
 ## Actions