- Extend _scope_allows() to accept optional location_id parameter
- Parse three-part scope format: name:resource:action:location_id
- Wildcard * in any segment (resource, action, location) matches all
- Two-part scopes (resource:action) remain backward-compatible
- Admin keys bypass scope checks (unchanged)
- Capability tokens already enforce location matching (unchanged)

Scope format examples:
  field-worker:harvest_event:write:loc-123  → only loc-123
  field-worker:harvest_event:write:*         → any location
  field-worker:harvest_event:write           → any location (backward-compat)