How many 2-Legged tokens can a Forge App have active at once?
I think the answer is 'more than any reasonable person would ask for', but I haven't been able to explicitly confirm this yet.
That's an interesting question. I don't think there's any limit to how many access tokens you can have at a single point time but I would definitely not recommend generating new token for each request. Not only is it wasteful but you could also run into rate limiting quotas.
The recommended practice is to generate one or more tokens on the server side (for example, one with viewables:read scope for public use, and one with additional scopes for internal use) and only refresh them when they expire.