List and query API tokens

Lists API tokens in the active scope for the API tokens page table: name, description, masked prefix (e.g. pc_live_7Qx9), granted scopes, creator, created/expiry timestamps, last-used time and IP, the CIDR allowlist, and lifecycle status. The full secret is NEVER returned by this endpoint — it is revealed exactly once at create/rotate time. This single endpoint also serves the iam.api_token.search_filter_sort action: q matches token name and prefix; the status filter mirrors the UI's Total/Active/Expired/Revoked chips. Validation: scopeId must be an accessible scope (NOT_FOUND semantics fold into 403/404 at the scope layer); status must be one of ACTIVE|EXPIRED|REVOKED; pagination/sort parameters must be within documented ranges — violations map to VALIDATION_FAILED (422). Async & state: Synchronous read; no state change. Errors: 401 when unauthenticated; 403 when the caller lacks IAM read permission on the scope; 422 on malformed filter/pagination parameters; 500 on read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required.