Fixes #280.

Summary

• Add created_at and refresh_token placeholder fields to token responses to prevent Pixelfed apps from crashing on undefined values
• Limit token request scopes to what was actually authorized in the auth code, since Pixelfed apps request more scopes than they registered with
• Filter timelines to media-only posts for Pixelfed apps

Test plan

• Verify Pixelfed Android and iOS apps can complete the OAuth flow
• Verify token responses include created_at and refresh_token
• Verify granted scopes don't exceed what was authorized
• Verify Pixelfed app timelines only show posts with media attachments