fix(16.3): disable Create token until a scope is selected

Client-side canSubmit now matches the 422 rule so Submit stays disabled
with an empty scope set (WR-02).

Co-authored-by: Cursor <cursoragent@cursor.com>

admin/tests/account/ApiTokenCreateDialog.test.ts

@@ -213,6 +213,8 @@ describe('ApiTokenCreateDialog step 1', () => {
     pending.release(envelope(scopes))
     await flushPromises()
     expect(dialog()!.querySelector('[data-scope="admin:read"]')).toBeTruthy()
+    // No scope selected yet — submit stays disabled (WR-02).
+    expect(dialog()!.querySelector<HTMLButtonElement>('[data-action="create-token-submit"]')!.disabled).toBe(true)
   })
 
   it('shows scopes failure alert when the scopes request fails', async () => {