2026.3.x: endpoint -ExecutionRole permissions don't apply to Grant-/Get-/Revoke-PSUAppToken -Integrated under any non-Permissive model

Versions: 2026.3.1 and 2026.3.2 (devolutions/powershell-universal, ubuntu-24.04)
Related: forum topics 56529 and 56533

Steps to reproduce
1. Set Api__SecurityModel to Integrated (also reproduces with High).
2. Create a role that carries the token permissions and is never assigned to anyone:
New-PSURole -Name 'TokenIssuer' -Permissions @('security.tokens/*') -Policy { param($User) $false }
3. Create an authenticated API endpoint with -ExecutionRole 'TokenIssuer' whose script calls Grant-PSUAppToken -Integrated.
4. Call it as a signed-in user in the Administrator role.
5. Create an anonymous endpoint (-Authentication:$false) with the same execution role and script, and call it.

Actual
- Step 4: Permission denied. The role specified does not have access to this resource.
- Step 5: Unauthenticated. Specify an app token...
- Get-PSUAppToken -Integrated and Revoke-PSUAppToken -Integrated fail the same way.
- The results are identical with and without -ExecutionRole.

Expected
The execution role's security.tokens permissions apply to the -Integrated token cmdlets the endpoint runs. Alternatively, those cmdlets are authorized as the server identity.

Impact
Under any model except Permissive, no endpoint can mint, list or revoke app tokens unless the caller's own roles carry security.tokens. An anonymous bootstrap endpoint can never mint one. The only way around it is to grant token permissions to every admin or switch to Permissive, and neither is acceptable for us.