feat(bridge): passive telemetry for partial scope revocation detection

[sangalo20]

Problem

The ConnectionHealthWorker can detect full revocation (refresh token rejected) but cannot detect partial scope revocation — e.g., a user revokes calendar.read but keeps profile. The broker is domain-agnostic and cannot actively test individual scopes.

Proposed Solution

Implement passive telemetry in nexus-bridge:

1. The nexus-bridge intercepts all outbound API calls from agents.
2. When a provider returns 403 Forbidden, the bridge captures the failing scope/endpoint context.
3. The bridge reports this to the broker via an internal telemetry endpoint (e.g. POST /internal/telemetry/scope-failure).
4. The broker marks the connection as degraded and records which scopes are failing.
5. The frontend can then surface a targeted re-auth prompt for the specific missing scopes.

Impact

• Connections degraded by partial revocation currently appear healthy to the worker
• Agents silently fail on 403s with no feedback to the user

References

• docs/healthchecks.md §7 Technical Debt
• nexus-broker/internal/service/connection_health.go