Fix cli.py to use ds.actions instead of ds.permissions

The create-token CLI command was checking ds.permissions.get(action)
instead of ds.actions.get(action) when validating action names. This
caused false "Unknown permission" warnings for valid actions like
"debug-menu".

This is the same bug we fixed in app.py:685. The Action objects are
stored in ds.actions, not ds.permissions.

The warnings were being printed to stderr (correctly) but CliRunner
mixes stderr and stdout, so the warnings contaminated the token output,
causing token authentication to fail in tests.

Fixes all 6 test_cli_create_token tests.

Refs #2534

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

datasette/cli.py

@@ -766,7 +766,7 @@ def create_token(
     actions.extend([p[1] for p in databases])
     actions.extend([p[2] for p in resources])
     for action in actions:
-        if not ds.permissions.get(action):
+        if not ds.actions.get(action):
             click.secho(
                 f"  Unknown permission: {action} ",
                 fg="red",