Fix Slack user scope install docs

[rianjs]

What changed

• align the checked-in Slack app manifest with the documented baseline scopes
• expand the README's extended user-token manifest so --as-user can use every current slck operation
• document storing both refreshed tokens after reinstalling the app

Why

The extended manifest granted broad scopes only to the bot token. User tokens installed from it received search-only scopes, so commands such as DM history failed with missing_scope under --as-user.

Validation

• parsed slack-app-manifest.yaml
• parsed both embedded README JSON manifests
• verified the checked-in baseline scope list matches the README baseline
• git diff --check