feat: personal API tokens

Tokens for scripts, made, listed and revoked on the account page. Each grants some of the person's own permissions
at chosen places (a product of theirs, a catalog whose team they're on, or the hub for moderators); every check is
the intersection with what they hold now. Tokens work only on routes that check a permission (session-only routes
answer token_not_allowed), are shown once and stored as hashes, note their last use, and mark the audit entries of
what they do.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/account/page.tsx

@@ -11,13 +11,18 @@ import { linkAccount, signOutComputers } from "./actions";
 import { AgeCard } from "./age-card";
 import { ChallengeCard } from "./challenge-card";
 import { LinkCard } from "./link-card";
+import { TokensCard } from "./tokens-card";
 
 export const metadata: Metadata = { title: "Account" };
 
 export default async function Account({ searchParams }: { searchParams: Promise<{ welcome?: string; age?: string }> }) {
   const me = await getMe();
   if (!me) redirect("/signin?next=/account");
-  const [account, age] = await Promise.all([api.account.get().then(unwrap), api.age.get().then(unwrap)]);
+  const [account, age, tokens] = await Promise.all([
+    api.account.get().then(unwrap),
+    api.age.get().then(unwrap),
+    api.account.tokens.get().then(unwrap),
+  ]);
   const { person, links, challenges, computers } = account;
   const params = await searchParams;
   const welcome = params.welcome !== undefined;
@@ -116,6 +121,8 @@ export default async function Account({ searchParams }: { searchParams: Promise<
           )}
         </CardContent>
       </Card>
+
+      <TokensCard data={tokens} />
     </div>
   );
 }