fix: remove sensitive send scope from reply and forward shortcuts

[infeng]

Summary

The mail:user_mailbox.message:send scope is sensitive and may
not be granted
in all environments. Since +reply, +reply-all, and +forward
default to
saving drafts (which only requires message:modify), this scope
should not be
a prerequisite for using these shortcuts. When --confirm-send is
used, the
send scope is now validated dynamically in the Validate phase,
preventing the
"draft created but send failed" scenario.

Changes

• Remove mail:user_mailbox.message:send from static Scopes in
  mail_reply.go,
  mail_reply_all.go, and mail_forward.go
• Add validateConfirmSendScope() in helpers.go — when
  --confirm-send is set,
  checks the token for send scope and fails early with a clear
  hint if missing
• Remove the scope from the test token in mail_shortcut_test.go
• Update the login scope example in lark-mail-reply.md skill
  reference
• Add regression tests covering +reply, +reply-all, +forward
  with
  --confirm-send when token lacks send scope
• mail_send.go retains the scope as it is explicitly designed
  for sending

Test Plan

• go test ./shortcuts/mail/... all passed
• TestConfirmSendMissingScopeReply — +reply --confirm-send
  returns missing_scope
• TestConfirmSendMissingScopeReplyAll — +reply-all --confirm-send returns missing_scope
• TestConfirmSendMissingScopeForward — +forward --confirm-send returns missing_scope
• Manual verification: +reply, +reply-all, +forward
  draft mode works without send scope granted

Related Issues

N/A

[CLAassistant]

All committers have signed the CLA.