fix(admin-panel): remove delete button from OAuth scopes page

[vbudhram]

Because

• A scope row is a foreign key target for accountAuthorizations rows, so a delete fails without a cascade.
• A cascade delete would drop a user's consent history, which we must keep.
• The admin panel showed a delete button for an action that cannot run safely.

This pull request

• Removes the delete button, the Actions column, and the red delete warning from PageOAuthScopes.
• Removes handleDelete, the adminApi.deleteOAuthScope call, the deletingId state, and the canDelete guard check.
• Rewords the page help text: a scope cannot be edited or deleted after creation, because a user's authorizations reference it.
• Replaces the delete test block with one test that asserts no delete control renders for AdminProd.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14581

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: packages/fxa-admin-panel/src/components/PageOAuthScopes/index.tsx and its index.test.tsx.
• Suggested review order: the component first, then the test.
• Risky or complex parts: none known. The change only removes UI. The create path and the guard for it stay as they are.

Screenshots (Optional)

The scopes table loses its Actions column and the red delete warning above it. No screenshot was captured for this branch, because the stack was not started.

Other information (Optional)

Out of scope for this pull request, per the ticket:

• AdminPanelFeature.DeleteOAuthScope and its guard config.
• The adminApi.deleteOAuthScope client method, which now has no caller.
• The DELETE /api/oauth-scopes/:id endpoint in fxa-admin-server.

A separate pull request removes the server side.

Local checks:

• nx test-unit fxa-admin-panel (frontend suite): 22 suites, 152 tests passed.
• nx lint fxa-admin-panel and tsc --noEmit both pass.

Two CSP failures in the package server test suite are present before this change and are not related to it. Playwright functional tests did not run locally. CI runs them.

[Copilot]

🟢 Approval recommended

The focused UI removal is complete, consistent with the stated scope, and covered by an appropriate regression test.

Pull request overview

Removes unsafe OAuth scope deletion controls while preserving scope creation and listing.

Changes:

• Removes deletion UI, state, handlers, and guard checks.
• Clarifies that existing scopes cannot be edited or deleted.
• Replaces deletion tests with an assertion that no delete control renders.

File summaries

File	Description
PageOAuthScopes/index.tsx	Removes scope deletion functionality and warning UI.
PageOAuthScopes/index.test.tsx	Verifies deletion controls remain unavailable.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.