Document permission group IDs in API token template URLs

[gzapf-cf]

Summary

Updates the API token template URLs page to document permission group IDs as a key value and to correct the resolution behavior, which differs between account token URLs and user token URLs.

Account token deep-links resolve a permissionGroupKeys entry by short key or by permission group ID, and surface a notice for unresolved or malformed input instead of dropping it silently. User token URLs keep the narrower contract (short keys only, exact name+type match, edit not write, silent drop on mismatch). The previous page described a single shared behavior, which is no longer accurate.

• Add a "Use permission group IDs" section: how to address any permission group by its stable ID (single and multiple), and where to look the IDs up (account-scoped List permission groups endpoint, permissions reference).
• Split the permission format guidance into account-token vs user-token rules.
• Update Troubleshooting to describe the account-token unresolved/malformed notice and the user-token silent-drop behavior.

Documentation checklist

• Is there a changelog entry? Not applicable — clarifies existing behavior, no new product surface.
• The change adheres to the documentation style guide.
• If a larger change - such as adding a new page- an issue has been opened. Not applicable — edits an existing page.
• Files which have changed name or location have been allocated redirects. Not applicable — no file moved or renamed.