fix: post /api/v1/system/tokens (#15410)

### What problem does this PR solve?

This PR aligns `POST /api/v1/system/tokens` in Go with the Python
implementation.

### Type of change

- Keep the token creation flow under the system API route.
- Preserve the owner-tenant authorization check.
- Generate and persist API tokens consistently with the current Go
service flow.
- Return the created token payload in the standard API response format.

Co-authored-by: Jin Hai <haijin.chn@gmail.com>

internal/service/api_token.go

@@ -84,7 +84,7 @@ func (s *SystemService) CreateAPIToken(tenantID string, req *CreateAPITokenReque
 	// token: "ragflow-" + secrets.token_urlsafe(32)
 	APIToken := utility.GenerateAPIToken()
 	// beta: generate_confirmation_token().replace("ragflow-", "")[:32]
-	betaAPIKey := utility.GenerateBetaAPIToken(APIToken)
+	betaAPIKey := utility.GenerateBetaAPIToken(utility.GenerateAPIToken())
 
 	APITokenData := &entity.APIToken{
 		TenantID: tenantID,