db: keep at most 1000 access tokens per OAuth client

Minting needs only the client secret, whatever its scopes, and
added one row per mint. Each mint now ends tokens past the newest 1000.

hscontrol/api/v2/oauth.go

@@ -103,7 +103,7 @@ func oauthTokenHandler(b Backend) http.HandlerFunc {
 
 		expiry := time.Now().Add(accessTokenTTL)
 
-		tokenStr, _, err := b.State.MintAccessToken(client.ClientID, scopes, tags, &expiry)
+		tokenStr, token, err := b.State.MintAccessToken(client.ClientID, scopes, tags, &expiry)
 		if err != nil {
 			writeOAuthError(w, http.StatusInternalServerError, "server_error", "could not mint access token")
 
@@ -114,7 +114,7 @@ func oauthTokenHandler(b Backend) http.HandlerFunc {
 			AccessToken: tokenStr,
 			TokenType:   "Bearer",
 			ExpiresIn:   int(accessTokenTTL.Seconds()),
-			Scope:       strings.Join(scopes, " "),
+			Scope:       strings.Join(token.Scopes, " "),
 		})
 	}
 }