Passport needs a "personal access client" to issue personal access tokens,
and only the seeder created it (production runs migrations, not the seeder),
so createToken threw "Personal access client not found".
- New idempotent command passport:ensure-personal-client, run by the
container entrypoint after the migrations.
- The tokens page now shows an error when the server fails instead of
doing nothing (es, en, ca).
- Tests: the command creates the client once; tokens can be created.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>