[Fleet] Without service token access and initial policy, can't set up Fleet Server

[jen-huang]

While testing locally, I found an issue:

• start local kibana without fleet-server
• create a role fleet agents:all, agent policies:none, settings:all, integrations:all and create a user with this role
• login with this user
• click on Add Fleet Server
• the resulting command misses service token, the service token API call returns with 403 (this happens even if fleet-server-policy exists)
• also the Fleet server policy was not created. Is it expected that to add a Fleet-server/Agent without a pre-existing agent policy, you can only do it with Agent policies:all role? (@jen-huang: this is expected but we should still account for it)

Originally posted by @juliaElastic in #181357 (comment)

[jen-huang]

the resulting command misses service token, the service token API call returns with 403 (this happens even if fleet-server-policy exists)

Good catch we rely on the user permissions to ES to generate the service token, I think I missed that part in the subfeature permission check here https://github.com/jen-huang/kibana/blob/ad3e60c16829cd14bb265dc927f1deb363814c4a/x-pack/plugins/fleet/server/routes/app/index.ts#L70

Per @nchaulet #181357 (comment)

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)