pub fn validate_scopes(scopes: &[String]) -> Option<String>
Return an error message if any scope is invalid; None if all valid. Custom scopes (prefix “custom:”) are accepted as valid extensions.