Add comprehensive scopes.md documentation for fine-grained access control system

- Document scope system architecture and relationship with Cognito
- Explain UI scopes vs server scopes and their purposes
- Detail methods vs tools access control differentiation
- Provide scope validation logic explanation
- Include configuration examples for different user roles
- Add security considerations and best practices
- Include troubleshooting guide for common issues

Addresses issue #35

Author: aarora79