test(api): share API v1 test helpers and check scopes in Go

Move the end-to-end call/setup/mint helpers to a suite-level test client
and the apiauth login/mustMint helpers to package level. Replace the
hardcoded vacuum x-scope enum with a Go test that every known scope is
a valid spec Scope; the gate already rejects unknown x-scope values.

api/.vacuum.yaml

@@ -44,14 +44,6 @@ rules:
     then:
       field: security
       function: defined
-  nd-operation-x-scope:
-    description: An operation's x-scope is a known scope. Cross-checks with x-module and security run in Go (server/apiv1 newGate).
-    severity: error
-    given: $.paths[*][get,put,post,delete,patch]['x-scope']
-    then:
-      function: enumeration
-      functionOptions:
-        values: [read, password]
   nd-operation-stability-level-required:
     description: Every operation declares its stability level, which the breaking-change gate relies on.
     severity: error