Get an API token's detail and usage read model

Retrieves the API token detail page read model for one API token: the token record (name, description, masked prefix, scopes, creator, created/expiry timestamps, last-used time and IP, CIDR allowlist, status) plus the usage panels — the recent call log (method, path, HTTP status, source IP, latency) and the 14-day call/error volume series. The full secret is never present in this response; only the non-sensitive prefix is shown. Validation: scopeId must be an accessible scope and apiTokenId must reference a token within it; unknown or out-of-scope ids map to NOT_FOUND (404). No mutation parameters exist. Async & state: Synchronous read; no state change. Errors: 401 when unauthenticated; 403 when the caller lacks IAM read permission on the scope; 404 when the token does not exist in this scope; 500 on read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response carries no ETag; rotate, revoke and delete do not check If-Match.