fix(orgtoken): restore flexible regex in TestList_NewestFirst

The PR #1683 fix to TestList used a literal column-name regex that
doesn't match the actual List() query. sqlmock uses regex matching:
- Actual query uses COALESCE(name,'') wrappers
- Literal 'name' doesn't match 'COALESCE(name,'')'
- Also missing WHERE clause and LIMIT

Revert to the flexible pattern used on main (SELECT id, prefix.*)
with explicit LIMIT allowance — proven working on main branch.

TestValidate_HappyPath 3-column fix is kept.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workspace-server/internal/orgtoken/tokens_test.go

@@ -145,7 +145,7 @@ func TestList_NewestFirst(t *testing.T) {
 
 	now := time.Now()
 	earlier := now.Add(-1 * time.Hour)
-	mock.ExpectQuery(`SELECT id, prefix, name, org_id, created_by, created_at, last_used_at FROM org_api_tokens ORDER BY created_at DESC`).
+	mock.ExpectQuery(`SELECT id, prefix.*FROM org_api_tokens.*ORDER BY created_at DESC( LIMIT $1)?`).
 		WithArgs(listMax).
 		WillReturnRows(sqlmock.NewRows([]string{"id", "prefix", "name", "org_id", "created_by", "created_at", "last_used_at"}).
 			AddRow("t2", "abcd1234", "zapier", "org-1", "user_01", now, now).