- who decides the supply of tokens and when these tokens are generated?
This question varies wildly from token to token. When people call Ethereum programmable money, it's because there is a massive level of programmability that can be done to something as simple as a token. Would you like to create a token that can be minted indefinitely by an admin? You could do that. Would you like it to programmatically mint and burn itself under certain specified circumstances? You can do that too. You can even change the balances of token holders based on various triggers (rebasing tokens), and much, much more.
This is one of the reasons why it so important to research new tokens before investing in them. Malicious tokens have more than enough ways to harm innocent users' investments, and even non-malicious tokens can be vulnerable to attacks if implemented poorly.
This is also why reputable projects verify their code on Etherscan. This allows potential users to look at the source code of the contracts that they'll be interacting with.
In the specific case of Aave, we don't have a better answer than what Ismael mentioned in the comments - that some AAVE is allocated for protocol development, and is likely not included in the circulating supply on Gemini. We'll try to check with Aave and update with any findings.
Update: Aave corroborated that there are ~3M tokens in the Ecosystem Reserve contract here (this is mentioned in their docs here), which would account for the vast majority of the outstanding tokens. They also added that not all 13M LEND tokens (Aave's original token) were migrated, which likely accounts for the rest.
