fix: personal access tokens failed with a 500 in production

Passport needs a "personal access client" to issue personal access tokens,
and only the seeder created it (production runs migrations, not the seeder),
so createToken threw "Personal access client not found".

- New idempotent command passport:ensure-personal-client, run by the
  container entrypoint after the migrations.
- The tokens page now shows an error when the server fails instead of
  doing nothing (es, en, ca).
- Tests: the command creates the client once; tokens can be created.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/PersonalAccessTokenTest.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Passport\Client;
+use Tests\TestCase;
+
+class PersonalAccessTokenTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function personalClients(): int
+    {
+        return Client::query()->get()
+            ->filter(fn (Client $client) => $client->hasGrantType('personal_access'))
+            ->count();
+    }
+
+    public function test_ensure_command_creates_the_personal_access_client_once(): void
+    {
+        $this->assertSame(0, $this->personalClients());
+
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+
+        $this->assertSame(1, $this->personalClients());
+    }
+
+    public function test_users_can_create_personal_access_tokens_once_the_client_exists(): void
+    {
+        $this->artisan('passport:ensure-personal-client')->assertSuccessful();
+        $user = User::factory()->approved()->create();
+
+        $response = $this->actingAs($user)->postJson('/web-api/personal-access-tokens', [
+            'name' => 'MCP TaskStream',
+            'scopes' => ['users:read'],
+        ]);
+
+        $response->assertCreated()->assertJsonStructure(['access_token']);
+        $this->actingAs($user)->getJson('/web-api/personal-access-tokens')
+            ->assertOk()
+            ->assertJsonFragment(['name' => 'MCP TaskStream']);
+    }
+}