fix: Distinguish caller mistakes from backend failures in CreateAPIToken

createToken's catch-all mapped every unmatched error to 400, so a
database outage reported itself as a malformed client request. Wrap the
genuine validation failures with ErrTokenInvalid and let the handler
answer 500 with a fixed message for everything else.

server/internal/api/tokens.go

@@ -62,9 +62,12 @@ func createToken(c *gin.Context) {
 	case errors.Is(err, services.ErrInvalidScope):
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "invalid_scope"})
 		return
-	case err != nil:
+	case errors.Is(err, services.ErrTokenInvalid):
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
+	case err != nil:
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create token"})
+		return
 	}
 
 	expiry := "no expiry"