fix(infra): bootstrap_sso --dns-only says which zone scope the token is missing

Running it with the corwins.media-scoped token updated the tunnel (account
scope) and then failed the DNS step with a bare 'Authentication error';
the record needs Zone:DNS:Edit on fhirworx.io specifically.

refs #1139

dev/scripts/bootstrap_sso.py

@@ -460,6 +460,13 @@ def _ensure_dns(client: httpx.Client) -> None:
     if not r.json().get("success"):
         err = r.json().get("errors", [{}])[0].get("message", "unknown")
         print(f"  FAIL: DNS list — {err}")
+        if "Authentication" in err:
+            # The tunnel write above only needs Account:Cloudflare Tunnel:Edit;
+            # this one needs Zone:DNS:Edit *on the fhirworx.io zone*. A token
+            # scoped to another zone passes the first and fails here.
+            print(
+                f"        hint: the token must include Zone:DNS:Edit for {DOMAIN} (zone {zone})"
+            )
         return
 
     existing = {rec["name"] for rec in r.json()["result"]}