API tokens

Personal access token management (session auth only).

Returns the token metadata plus a one-time `token` field holding the plaintext secret — store it now; it is never shown again. Token management requires a session (an API token cannot mint or revoke tokens).