feat: personal API tokens

Tokens for scripts, made, listed and revoked on the account page. Each grants some of the person's own permissions
at chosen places (a product of theirs, a catalog whose team they're on, or the hub for moderators); every check is
the intersection with what they hold now. Tokens work only on routes that check a permission (session-only routes
answer token_not_allowed), are shown once and stored as hashes, note their last use, and mark the audit entries of
what they do.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/lib/api.ts

@@ -44,6 +44,9 @@ export type AuditEntry = ConsoleData["audit"][number];
 export type CaseSummary = Data<V1["cases"]["get"]>["cases"][number];
 export type CasePage = Data<ReturnType<V1["cases"]>["get"]>;
 export type NotificationEntry = Data<V1["notifications"]["get"]>["notifications"][number];
+export type TokenList = Data<V1["account"]["tokens"]["get"]>;
+export type TokenEntry = TokenList["tokens"][number];
+export type TokenScope = TokenList["scopes"][number];
 export type CatalogPage = Data<ReturnType<V1["catalogs"]>["get"]>;
 export type CatalogMember = Data<ReturnType<V1["catalogs"]>["members"]["get"]>["members"][number];
 export type CatalogInvite = Data<ReturnType<V1["catalogs"]>["invites"]["get"]>["invites"][number];