feat: personal API tokens

Tokens for scripts, made, listed and revoked on the account page. Each grants some of the person's own permissions
at chosen places (a product of theirs, a catalog whose team they're on, or the hub for moderators); every check is
the intersection with what they hold now. Tokens work only on routes that check a permission (session-only routes
answer token_not_allowed), are shown once and stored as hashes, note their last use, and mark the audit entries of
what they do.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -478,8 +478,8 @@ Phases for products, catalogs and imports (products.md, console.md, imports.md):
    (to look into with the importer spike).
 3. Cases (reports, appeals, reviews), file blocks and the catalogs' changes feed; notifications; API tokens;
    two-factor sign-in for sensitive permissions. Cases and notifications **done** (2026-11-05), without email, canned
-   reasons, moderator notes or second approval. File blocks **done** (2026-11-05); API tokens and two-factor sign-in
-   next.
+   reasons, moderator notes or second approval. File blocks and API tokens **done** (2026-11-05); two-factor
+   sign-in next.
 4. Imports: grants, recorded grants, requests, unclaimed creators, the job queue, `t5de-importer` (after its spike).
 5. Charts and stats; mirroring between catalogs.