A member cannot mint an admin-scope token; ro and rw tokens stay as they are #2409

Replaces #2386. Token scopes on main are global (ro, rw, admin; scopeAllows in src/core/tokens.ts). An rw token already reaches only what its holder may write, because every route checks the user's own permission on the repository. Both tries narrowed or refused a member's rw token, which broke test/branches.test.ts: there bob, a member, mints rw and must be refused only later, on alice's repository.

Done looks like:

• [ ] POST /api/v1/tokens, the token page and any MCP token tool refuse scope: "admin" to a non-admin with 403 and one plain sentence. ro and rw minting is unchanged for everyone.
• [ ] Test: a member gets 403 for admin and 201 for rw; that rw token gets 403 on another account's repository; an admin can still mint admin.
• [ ] Run test/branches.test.ts and every file that mints tokens (grep -l api/v1/tokens test/*.ts) and quote the result. No existing assertion changes.

Parked by the crew: the check failed and the decider saw no point in another try (pull #2413 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed and the decider saw no point in another try (pull #2414 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed and the decider saw no point in another try (pull #2413 closed)
2. the check failed and the decider saw no point in another try (pull #2414 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

replaced by #2425, the same work. It now waits for the runner fix #2416, runs the type check, and must quote its first red line, because both reds were unnamed.