Auto-detect missing scopes and re-auth

Added token_has_all_scopes() to ApiClient — reads stored
token.json and checks if all requested scopes are present.
If token exists but lacks calendar.readonly, the auth popup
is shown instead of silently failing in the sync engine.

src/app.rs

@@ -69,7 +69,7 @@ pub enum SyncCommand {
 
 impl App {
     pub fn new(db: Arc<Db>, api_client: Arc<ApiClient>, sync_tx: mpsc::Sender<SyncCommand>, _calendar_events_shared: Arc<tokio::sync::Mutex<Vec<CalendarEvent>>>) -> Self {
-        let has_token = api_client.has_token();
+        let has_token = api_client.has_token() && api_client.token_has_all_scopes();
         let (auth_tx, auth_rx) = std_mpsc::channel();
 
         let show_popup = if has_token {