Scoped PATs - UI Follow Up

### Description

Now that the core scoping work is done, a few UX improvements worth considering for the token creation modal:

- Expiry should be opt-out, not opt-in. Default to "expires" with some quick presets (30 days, 60 days, 90 days, 1 year, similar to what GitHub does). "No expiration" should be the deliberate choice, not the default.
- Access level as a required radio button. Instead of the current toggle, make it a required choice between "Read" and "Read + Write" so users have to consciously pick one. Mandatory field, no default selected.
- Callout styling. The warning text (e.g. "no teams selected = all teams") should use an actual callout/alert component instead of just colored text. Makes it harder to miss.
- Placeholder text in the token name field. Something like "e.g. cursor-readonly-team-a" to nudge users toward descriptive names.
- Token permissions visible in the overview. The tokens list should show what each token can actually do at a glance: read/write, which teams, admin access. Right now you have to remember what you set when you created it.

### Epic/Story

_No response_

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate