chore(deps): bump campus-suite to weekly head 9e37b85 (campus #658 alignment check)

[nycomp]

Summary

Alignment check after campus nyjc-computing/campus#658 (merged to weekly, head 9e37b85): storage flip for tokens/auth_sessions/device_codes to the RFC 6749 scope string, plus removal of two broken legacy expiry_seconds shims in the session/device_code resource mappings. Result: no client changes required — this PR is the lockfile bump only, keeping CI testing against the latest weekly.

Why nothing broke

#658 is a storage-layer change: no route files touched, and resource/API shapes are unchanged by design (AuthSession/DeviceCode resources keep emitting scopes lists per #648 decision 4; OAuthToken resources went scope-only in #657, which the client already pins).

Alignment check evidence (campus-suite @ 9e37b85)

• Full test suite: 80 passed unchanged — every wire-shape pin (token endpoint, credentials resources, PATCH body) still accurate.
• OAuthToken: resource keys unchanged (scope, no scopes); to_storage() emits the scope string; from_storage() round-trips both the new string and legacy list records.
• AuthSession / DeviceCode: new scope property; to_storage() emits scope string only; to_resource() still emits the scopes list; from_storage() tolerates both shapes (so backfill ordering is decoupled from deploy).
• Client request bodies: unaffected — the client never sends expiry_seconds to sessions/device codes, and sessions.new()'s scopes list intake is unchanged (routes untouched by #658).

Looking ahead

#658 unblocks the last #648 checklist item (remove the OAuthToken expiry_seconds alias, item 2) — campus notes it was gated on this client switching its POST to expires_in, which #45 did. When that removal PR lands, the client is unaffected: it has zero expiry_seconds call sites and its contract tests already pin expires_in-based shapes.