test(postit): pin blogs scope on bearer, fix post-refactor tests

Two intertwined jobs here:

1. Diagnostic test for the production 401 we see when PostIt
   talks to Yavsc.Blogs. The hypothesis this test isolates:
   the access token sent on the wire is missing the 'blogs'
   scope that Yavsc.Blogs' BlogScope policy requires (see
   Yavsc.Blogs/Program.cs: RequireClaim(JwtClaimTypes.Scope,
   "blogs")). The test fakes a single HttpMessageHandler,
   captures the outbound bearer, decodes the JWT, and asserts
   the 'scope' claim contains 'blogs'. It does not stand up a
   server, an OIDC stub, or any network listener. Result: the
   scope is present in the access_token we construct, so the
   401 is not on the client side — most likely the IdP at
   Yavsc.Org is not issuing 'blogs' as a recognised scope.

2. Mechanical fix of the three test files that broke during
   the Settings model refactor (PostIt.Settings ->
   PostIt.ViewModels.Settings; ApiUrl -> BusinessApiUrl;
   Scopes/RedirectUri moved under Authentication;
   DefaultDesktopRedirectUri is on AuthenticationSettings in
   the global namespace). Also restored the BaseAddress
   setup that BlogApiClient does in production in
   LoginAndPersistAsync / the reloaded-client path of
   YavscApiClientTests, so the two integration tests that
   call CallAsync("posts") directly don't trip on
   'request URI must be absolute or BaseAddress must be set'.

Test status: 45 / 45 passing in PostIt.Tests.

src/PostIt/PostIt.Desktop/PlatformBootstrap.cs

@@ -24,7 +24,7 @@ internal static class PlatformBootstrap
         // Use the custom-scheme redirect on Desktop. Loopback is only
         // a fallback for platforms that cannot register postit://
         // (see Settings.DefaultLoopbackRedirectUri for that path).
-        Platform.DefaultRedirectUri = Settings.DefaultDesktopRedirectUri;
+        Platform.DefaultRedirectUri = AuthenticationSettings.DefaultDesktopRedirectUri;
         Platform.CustomScheme = "postit";
     }
 }