docs(client): document ClearanceOptions.scope as reserved

[cport1]

What changed

ClearanceOptions.scope (and the data-scope script attribute that feeds it) was documented as a route-group scope that limits where a clearance token is valid. No validator restricts a token by that value.

The JSDoc now says what is true:

• scope is reserved. It is still sent with the mint request, and passing it still has no effect, so no existing page breaks.
• A clearance token is bound to the organization. Any of its sites accepts it, subject to expiry, the fingerprint deny list and the verification level required by the path it is used on.
• A path's verification level is the way to require stronger proof on sensitive routes.

Also adds a CHANGELOG entry under Unreleased. No runtime change.

Checks

• tsc --noEmit for packages/client passes.