Returns the OAuth scopes the signed-in user is permitted to register on new or updated apps, grouped by category. Use this to populate scope-picker UIs and to validate allowedScopes client-side before submitting to createOAuthApp / updateOAuthApp.

The result is role-aware. Org admins (members of an admin user group) receive every registered scope; everyone else is filtered to exclude admin-only scopes: org:write, org:admin, user:invite, user:delete, usergroup:write, team:write, config:write, crawl:write, crawl:delete.

Each key in the scopes map matches the category field on the OAuthScopeInfo entries it contains. A category may appear with an empty array when every scope it contains is restricted for the caller — treat empty buckets as "no permitted scopes in this group", not as a missing category.

Shares the per-user rate limiter applied to every /oauth-clients/* route (default 1000 req/min, MAX_OAUTH_CLIENT_REQUESTS_PER_MINUTE).