fix(16.3): disable Create token until a scope is selected

Client-side canSubmit now matches the 422 rule so Submit stays disabled
with an empty scope set (WR-02).

Co-authored-by: Cursor <cursoragent@cursor.com>

admin/src/components/account/ApiTokenCreateDialog.vue

@@ -61,7 +61,9 @@ const plaintextInput = ref<HTMLInputElement | null>(null)
 const copyButton = ref<HTMLElement | null>(null)
 
 const starChecked = computed(() => checked.value.has('*'))
-const canSubmit = computed(() => !scopesLoading.value && !scopesFailed.value && scopes.value.length > 0 && !busy.value)
+const canSubmit = computed(
+  () => !scopesLoading.value && !scopesFailed.value && scopes.value.length > 0 && checked.value.size > 0 && !busy.value,
+)
 
 function pad(value: number): string {
   return String(value).padStart(2, '0')