Fix test_auth_create_token - template variables and action abbreviation

Fixed two bugs preventing the create token UI and tests from working:

1. **Template variable mismatch**: create_token.html was using undefined variables
   - Changed `all_permissions` → `all_actions`
   - Changed `database_permissions` → `database_actions`
   - Changed `resource_permissions` → `child_actions`

   These match what CreateTokenView.shared() actually provides to the template.

2. **Action abbreviation bug**: app.py:685 was checking the wrong dictionary
   - Changed `self.permissions.get(action)` → `self.actions.get(action)`

   The abbreviate_action() function needs to look up Action objects (which have
   the `abbr` attribute), not Permission objects. This bug prevented action names
   like "view-instance" from being abbreviated to "vi" in token restrictions.

Refs #2534

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

tests/test_auth.py

@@ -137,7 +137,6 @@ async def test_no_logout_button_in_navigation_if_no_ds_actor_cookie(ds_client, p
     )
 
 
-@pytest.mark.xfail(reason="Actor restrictions need additional work, refs #2534")
 @pytest.mark.parametrize(
     "post_data,errors,expected_duration,expected_r",
     (