Lists every active personal access token across every member of the org, paginated, with each token's owner attached (including owners who've since been deleted from the org — see ownerDeleted on AdminPatListItem). For incident response: a departed employee or a compromised laptop, where only the token's own creator could otherwise see or revoke it.

Requires org-admin privileges (userAdminCheck): a non-admin caller gets 403 (ForbiddenError, message "You need admin access to do this. Ask an admin in your organisation."). The admin check runs before the query is validated, so a non-admin gets 403 even for an invalid page or limit. Query parameters other than page and limit are ignored. A page past the end answers 200 with an empty data array.