[Bug] Cannot create Personal Access Token - "Bad Request" error

**Describe the bug**
When attempting to create a Personal Access Token (PAT) in API Management → Authorization → Personal Access Tokens, I receive a "Bad Request" error immediately after clicking "Confirm". This completely blocks me from using the Web SDK to integrate my bot into my website.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to 'API Management' → 'Authorization' → 'Personal Access Tokens'
2. Click on 'Add' to create a new token
3. Fill in the form: name "Secret token", expiration "Custom 2026-06-16", permissions "Bot Management + Chat Management", workspace "Personal"
4. Click on 'Confirm'
5. See error: "Bad Request" with log ID

**Expected behavior**
The Personal Access Token should be created successfully so I can use the Web SDK to embed my chatbot on my website.

**Screenshots**
I can provide screenshots of the error if needed.

**Additional context**
- Bot ID: 7640602617497174021
- Space ID: 7640542025359867912
- Account: userddu54z@user58... (Free plan)
- Already purchased 1,000,000 Coze tokens ($10) and error persists
- Log IDs: 20260518030120AB0AF1A307D6BB9A2F7B, 20260518031135650D67B9...
- Tried multiple times with different permission combinations and still get the same error

A clear and concise description of what the bug is.

**To Reproduce**

Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

**Expected behavior**

A clear and concise description of what you expected to happen.

**Screenshots**

If applicable, add screenshots to help explain your problem.

**Version:**

Please provide the version of {project_name} you are using.

**Environment:**

The output of `go env`.

**Additional context**

Add any other context about the problem here.

Start at API Management → Authorization → Personal Access Tokens and reproduce the failure using the reported form values and permission combinations. Use the supplied log IDs to trace the Bad Request response and identify the affected token-creation entry point. Done means a Personal Access Token is created successfully and can be used with the Web SDK.

Written by the indexing model from the issue text.