Scoped PAT with Full access gets 403 revealing project API keys; classic PAT succeeds

# Bug report - [x] I confirm this is a bug with Supabase, not with my own application. - [X] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug A scoped/fine-grained personal access token created using the **Full access** preset cannot reveal project API keys through the Management API. This causes `supabase link` to fail because the CLI requests the project's API keys with `reveal=true`. The same Supabase account, project, CLI command, and environment work correctly when I replace the scoped PAT with a classic PAT. The user that created both tokens is the **Owner** of the organization, and the scoped PAT shows **API Keys: Read-write**. I reproduced this with both: - a project-scoped PAT - an organization-scoped PAT Both were created with the **Full access** preset and both fail identically. ## To Reproduce 1. Sign in as the Owner of a Supabase organization/project. 2. Create a new scoped/fine-grained personal access token. 3. Set Resource access to either: - the specific project, or - the containing organization. 4. Select the **Full access** permission preset. 5. Confirm the resulting token has **API Keys: Read-write**. 6. Set the token as `SUPABASE_ACCESS_TOKEN`. 7. Run: ```sh supabase link --project-ref <PROJECT_REF> --debug