fix: add locations.readonly scope to OAuth install request

The /locations/search endpoint requires locations.readonly scope.
Without it the company token gets 401 when trying to list locations
during bulk install, blocking the per-location token exchange.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/ghl/oauth.go

@@ -62,6 +62,7 @@ func (h *OAuthHandler) HandleInstall(w http.ResponseWriter, r *http.Request) {
 		"conversations.readonly",
 		"contacts.readonly",
 		"contacts.write",
+		"locations.readonly",
 	}, " ")
 
 	authURL := fmt.Sprintf(