Okta: strict mode to reject management tokens the emulator never issued

Problem

Okta answers 401 with E0000011 (Invalid token provided) to a management API call made with an API token it never issued. The emulator authenticates any Authorization header on /api/v1 routes as the default fallback user, so a made-up SSWS token can list, create, suspend, or delete users, and a revoked access token keeps working there. Tests asserting that an invalid credential fails cannot represent it, and the Okta emulator has no strict mode to opt into.

Proposal

• Add okta.strict_scopes, matching the Google, Slack, and Linear settings: in strict mode, an SSWS API token or bearer access token on /api/v1 routes that does not come from seed config, server options, or an OAuth exchange returns 401 with E0000011.
• Keep the fallback user in the default mode.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/okta-strict-management-tokens. Happy to open a pull request for it.