Fix Workforce OAuth: use form-encoded body and correct scope

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/workforce.js

@@ -26,13 +26,13 @@ async function getWorkforceToken() {
   }
   const res = await fetch(`${baseUrl}/api/oauth/token`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
       grant_type: 'password',
       username: creds.email,
       password: creds.password,
-      scope: 'default',
-    }),
+      scope: 'me',
+    }).toString(),
     signal: AbortSignal.timeout(10000),
   })
   if (!res.ok) throw new Error(`Workforce OAuth failed: ${res.status}`)