Add per-role HTTP method scoping to minted tokens

Every token this engine mints is as powerful as the apps it can reach: a
read-only integration can still write to the *arr. arrproxy v0.5.0 accepts
a method scope at mint time, so let a role pin its tokens to it.

- Add an optional role field methods, uppercase-normalized, de-duplicated
  and validated against the known HTTP methods at role write.
- Forward the role's scope as methods on the arrproxy mint request and
  echo it in the creds response alongside apps/subject.
- Omit the field entirely when a role has no scope, so an arrproxy
  predating method scoping sees an unchanged request.
- Cover normalization, rejection, pass-through and the unscoped case.

client.go

@@ -63,8 +63,11 @@ func newClient(config *arrstackConfig) (*arrproxyClient, error) {
 // mintTokenRequest is the payload for POST /api/admin/tokens. The subject MUST
 // carry the "vault:arrstack:" prefix or arrproxy rejects the request.
 type mintTokenRequest struct {
-	Subject    string   `json:"subject"`
-	Apps       []string `json:"apps"`
+	Subject string   `json:"subject"`
+	Apps    []string `json:"apps"`
+	// Methods limits the token to those HTTP methods. Omitted when empty so
+	// arrproxy versions predating method scoping see the request unchanged.
+	Methods    []string `json:"methods,omitempty"`
 	Label      string   `json:"label"`
 	TTLSeconds int64    `json:"ttl_seconds"`
 }