diag: invalid_grant is SSO auth-method mismatch, not bad creds

- feat: creds-test.sh gum probe for SMTP vs PeerTube auth + PeerTubeService::probeAuth()
- feat: app-token.sh gum probe for long-lived PeerTube app token (client_credentials)
- docs: add copy-paste proof commands to demonstrate the SSO break to admins

justfile

@@ -515,6 +515,19 @@ backup-snapshot:
 # Utils
 # ============================================================================
 
+[group('utils')]
+creds-test:
+    # Probe the SMTP + PeerTube credentials stored in the DB (gum UI).
+    #   --instance / --channel to override the stored PeerTube values
+    #   --show-pwd to reveal the decrypted password (interactive confirm)
+    @bash scripts/creds-test.sh
+
+[group('utils')]
+app-token:
+    # Probe whether a long-lived PeerTube app token is obtainable.
+    #   --instance https://videos.erg.be --client <id> --secret <secret>
+    @bash scripts/app-token.sh
+
 [group('utils')]
 clean:
     @rm -f app/error.log