Admin: list every active personal access token in the org

Lists every active personal access token across every member of the org, paginated, with each token's owner attached (including owners who've since been deleted from the org — see ownerDeleted on AdminPatListItem). For incident response: a departed employee or a compromised laptop, where only the token's own creator could otherwise see or revoke it.

Requires org-admin privileges (userAdminCheck) — note this returns 400, not 403, for a non-admin caller (shared middleware behavior across the codebase, not specific to this route).