When Anthropic setup-token auth is used, the OAuth usage endpoint returns
403 because setup-token only grants user:inference scope, not user:profile.
This change:
1. Returns a clear, actionable error message suggesting `claude login`
(full OAuth) when the scope error occurs and no web session fallback
is available, instead of the generic 'HTTP 403: ...' message.
2. Adds a post-onboard note during setup-token flow warning users that
usage tracking in /status requires the full OAuth flow.
3. Adds a test for the no-fallback scope error path.
Refs:
- https://github.com/anthropics/claude-code/issues/16075
- https://github.com/anthropics/claude-code/issues/15243
- https://github.com/anthropics/claude-code/issues/12020
