docs(cli): align Token scopes section and command help with the #883 grant-store model #50

The campus authorization model changed under epic nyjc-computing/campus#883 (landed via #884-#890 and #900): management authority now comes from DB-backed resource-keyed grant rows (administered via /auth/v1/grants/, "who can administer what" is GET /grants/) plus a single env-nominated super-admin root (AUTH_SUPER_ADMIN). The designated-admin env vars (AUTH_ADMIN_USER_IDS, AUTH_USERS_ADMIN_USER_IDS) are retired and no longer consulted; the two-leg identity×scope gate lives on only in the form "grant row AND token scope ceiling".

CLI text that still teaches the retired model:

• README "Token scopes" section: "Management scopes are monotonic…", "the authorizing account must also be a designated admin user server-side (campus invariant A8): clients scopes consult AUTH_ADMIN_USER_IDS, users scopes consult AUTH_USERS_ADMIN_USER_IDS (a clients-admin is not a users-admin)" — both stale. A8 now has the root carve-out and grant rows replace the env-var leg.
• campus user command help (campus_cli/auth/user.py, feat(cli): campus user * management commands (#42) #46): each command says "Requires the users:read/mod/write/admin scope (login with campus auth login --scope users:…)". Under the new model the scope is only half the story (grant row AND scope ceiling), and a root/holders of grant rows may need no users:* scope at all.
• campus client admin-surface help — same pattern for clients:* scopes.
• campus auth status output could surface the caller's grant rows (GET /grants/check) so agents can see effective authority, not just token scopes — natural companion to feat(cli): campus auth status — show stored token identity and scopes #45.

Also consider: the CLI has no grants command group; GET/POST/DELETE /auth/v1/grants/ (the #886 administration surface) is curl-only today. A campus grant list/grant/revoke group would make the matrix manageable from the CLI — the "who can administer what" query the epic's acceptance calls for.

Suggested split: (1) README + help text correction (small, accurate-to-model wording); (2) campus grant command group (feature); (3) status showing grant rows (enhancement on top of #45).

Refs: nyjc-computing/campus#883, nyjc-computing/campus#900, nyjc-computing/campus#872 (superseded by Option D), #42, #45, #46