Token and app-password pages ignore RBAC

## What

token/app-password RBAC: which permission lets a service account create tokens, and the Tokens & App passwords page ignores RBAC.

## Want

- Token/app-password RBAC: which permission lets a service account create tokens,
- The Tokens & App passwords page ignores RBAC

## Ideas this came from

- [#9504 What permission is required for a service account to create/edit token for users?](https://github.com/goauthentik/authentik/issues/9504) — Describe your question/ What permission is required for a service account to create/edit token for users? I'm trying to set up a service account that allows API
- [#16858 RBAC permissions not working for Tokens & App passwords page](https://github.com/goauthentik/authentik/issues/16858) — I want to create a cut-down role which only allows: - Add/edit/create of users - Assignment to certain groups - Creation of app passwords 3rd is proving trouble

Start by tracing the Tokens & App passwords page and its RBAC permission checks, then read the linked issues #9504 and #16858 for the expected service-account permission and current behavior. Done means the required permission is clear and the page respects RBAC for token and app-password actions.

Written by the indexing model from the issue text.