feat(tokens): add API token scoping (workspace and permission sets)

[martsokha]

Context

API tokens currently inherit the account's full permissions. Programmatic integrations should follow the principle of least privilege.

Requirements

• Each API token can be scoped to specific workspaces
• Each API token can be scoped to a subset of permissions
• A scoped token can only access resources within its designated workspaces and can only perform operations allowed by its permission set
• Token creation validates that requested scopes are a subset of the account's actual permissions
• Existing unscoped tokens continue to work (backwards compatible)

References

• Server docs: SECURITY.md - API Tokens