Currently wpa_supplicant doesn't support FT in AP mode. FT-PSK and FT-EAP are simply not negotiated with the STA. FT-SAE gets negotiated but then the key derivation is not supported, leading to a authentication failure.
Even if support for FT in AP mode is introduced in wpa_supplicant in the future, it will require additional parameters as the nas identifier and the mobility domain, which are currently not provided by NM.
Disable all FT key-mgmts in AP mode since they are useless and cause issues (FT-SAE).
See also: https://mail.gnome.org/archives/networkmanager-list/2022-March/msg00016.html