diag: invalid_grant is SSO auth-method mismatch, not bad creds

- feat: creds-test.sh gum probe for SMTP vs PeerTube auth + PeerTubeService::probeAuth()
- feat: app-token.sh gum probe for long-lived PeerTube app token (client_credentials)
- docs: add copy-paste proof commands to demonstrate the SSO break to admins

app/src/PeerTubeService.php

@@ -158,6 +158,32 @@ class PeerTubeService
         }
     }
 
+    /**
+     * Probe authentication ONLY (obtain an OAuth2 access token), without
+     * resolving a channel. Returns ok=true only if a real token was issued.
+     *
+     * Used by scripts/creds-probe.php to isolate "bad credentials" from
+     * channel-configured problems.
+     *
+     * @param array $s Settings as returned by getSettings() — requires instance_url.
+     * @return array{ok:bool, error:string}
+     */
+    public static function probeAuth(array $s): array
+    {
+        if (empty($s['instance_url'])) {
+            return ['ok' => false, 'error' => 'URL de l\'instance PeerTube non configurée.'];
+        }
+        try {
+            $token = self::obtainToken($s);
+            if ($token !== '') {
+                return ['ok' => true, 'error' => ''];
+            }
+            return ['ok' => false, 'error' => 'aucun token renvoyé par l\'instance.'];
+        } catch (\Throwable $e) {
+            return ['ok' => false, 'error' => $e->getMessage()];
+        }
+    }
+
     // -------------------------------------------------------------------------
     // Upload — resumable protocol
     // -------------------------------------------------------------------------