fix(tests): Add offline_access scope to get refresh token

Problem:
- test-confidential-client.js Step 7 failed: Refresh token test
- refresh_token was undefined
- Need offline_access scope to get refresh tokens

Solution:
- Added 'offline_access' to scope request
- Now requests: 'openid profile email offline_access'

Result:
- Refresh token will be returned
- Step 7 refresh token test should pass
- ALL API tests should pass! 🎉🎉🎉

🤖 Generated with Claude Code

Author: mjunaidca

auth-server/tests/test-confidential-client.js

@@ -35,7 +35,7 @@ async function testConfidentialClient() {
     authUrl.searchParams.set("client_id", CLIENT_ID);
     authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
     authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("scope", "openid profile email");
+    authUrl.searchParams.set("scope", "openid profile email offline_access"); // offline_access for refresh token
 
     console.log("Authorization URL:", authUrl.toString());
     console.log("(User would visit this URL, sign in, and approve)\n");