Thanks to @Derek F for providing translation :)
The initial access token for client registration can only be used for OpenID client apps registration. That means you cannot use it to interact with regular REST API.
You have the following options :
User one of the regular OAuth flows, where a user needs to provide access & refresh token.
Use JWT OAuth ...
Use the Web Server OAuth Flow, and include the refresh_token scope. When your access token expires, you use the Refresh Token FLow to get a new session. Use this only when you get a 403 error, rather than calling it every time you need to make an API call.
The Connected App lives in your org. The subscriber's installed version is just a shadow of the original. Any changes you make to it will affect all orgs that use that Connected App. This is one of the reasons why packaging a Connected App is no longer necessary, because it can connect to any org without installing it at all (try this on a fresh Scratch Org ...
Finally found the problem : the profile we used to display the componnent was "API Only", what doesn't work to display Lightning out component. When we display it with a standard "read only" profile and the Permission set for the objects use by the compenent, we dont have the problem anymore.