Enforce permissions on sensitive token and IP management routes

## Description

The token management routes in `src/auth-service/routes/v2/tokens.routes.js` currently only use authentication (`enhancedJWTAuth`) without proper permission checks. This creates a security gap where any authenticated user can potentially access sensitive token operations and IP management functions.

## Affected Routes

Routes that need permission enforcement include:
- Token CRUD operations (create, read, update, delete, regenerate)
- IP blacklisting/whitelisting operations
- IP range and prefix management
- Token listing and verification endpoints

## Security Impact

Without proper permission checks, authenticated users may be able to:
- View all tokens in the system
- Create/modify/delete tokens they shouldn't have access to
- Manipulate IP blacklists and whitelists
- Access sensitive token metadata

## Recommendation

Add `requirePermissions` middleware with appropriate permission scopes to all sensitive routes, following the pattern used in other protected endpoints.

## Related

- PR: https://github.com/airqo-platform/AirQo-api/pull/5159
- Comment: https://github.com/airqo-platform/AirQo-api/pull/5159#discussion_r2317157602
- Requested by: @Baalmart