Require the ActivityPub capability for OAuth access tokens

[pfefferle]

Proposed changes:

OAuth access tokens are now tied to the activitypub capability. create(), validate(), and refresh() refuse a user who doesn't have it, so a user who was never enabled for ActivityPub, or had it removed, can't get or keep a connected-app token.

I check the capability directly instead of user_can_activitypub() on purpose: that helper also short-circuits on the site's actor mode, so it would have rejected real, capable users on blog-only and single-user sites, where per-user actors aren't exposed but the capability is still the right signal. refresh() runs the check before it deletes the old token, so a failed refresh never destroys a still-valid grant.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• On a site in "both" or user mode, remove the activitypub capability from a user, then run the OAuth flow for them from a client: token issuance returns 403, and an existing token stops validating.
• Give the capability back: the same client can obtain and use a token again.
• Switch the site to blog-only mode with a capable user connected: their token keeps working. This is the case the direct capability check preserves.

Changelog entry

A changelog entry is already committed to the branch (.github/changelog/oauth-token-capability-check), so the "Skip Changelog" label isn't needed.

[Copilot]

Pull request overview

This PR tightens OAuth C2S access control by requiring the activitypub capability for issuing, validating, and refreshing OAuth access tokens, ensuring tokens cannot be obtained or used by users who are not enabled for ActivityPub.

Changes:

• Enforce an activitypub capability check in Token::create(), Token::validate(), and Token::refresh() via a shared helper.
• Add PHPUnit coverage for capability-gated token issuance/validation/refresh behavior and bearer-token REST authentication behavior.
• Add a changelog entry documenting the behavioral change for end users.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
includes/oauth/class-token.php	Adds centralized capability enforcement for token create/validate/refresh.
tests/phpunit/tests/includes/oauth/class-test-token.php	Adds tests ensuring token operations reject users lacking the activitypub capability, plus blog-only mode coverage.
tests/phpunit/tests/includes/oauth/class-test-server.php	Adds test ensuring bearer-token auth rejects users lacking the activitypub capability.
.github/changelog/oauth-token-capability-check	Documents the user-facing behavior change in the release notes.