Add self-service API tokens (PATs) with UI + Bearer auth (#119)

Personal access tokens so scripts/CI can call the management API without an
OIDC browser session. Each logged-in user mints their own token; it
authenticates as the creator (groups snapshotted at mint, mirroring the proxy's
browser AuthToken), and the existing authz layer (Permission.effectiveFor /
roles.resolveEffective) applies unchanged. Local groups and owned-domain rights
are recomputed live; only SSO/LDAP group membership is the mint-time snapshot.

- models/api_token.js: new ApiToken model (prx_<id>_<secret> format; id is the
  lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/
  authenticate(); optional expires_at; best-effort last_used_on; groups
  snapshot. No _ttl (persists). Deliberately NOT wrapped in ModelPs (so the
  last_used_on write on the auth path doesn't spam the socket).
- routes/api_token.js: self-service CRUD (list/get/update/delete/rotate),
  owner-scoped (created_by === reqUsername(req), 403 otherwise).
- middleware/auth.js + models/auth.js: accept `Authorization: Bearer prx_...`
  (precedence over the auth-token session header). Builds a synthetic req.token
  that satisfies the only three req.token reads (auth.js .user/.groupsArray,
  authz.js reqUsername .created_by) so the authz layer works unchanged.
  checkApiToken collapses every failure to one generic 401 (no leak).
- views/api_tokens.ejs + routes/render.js (GET /api-tokens): self-service page
  (forceLogin, no admin gate) — create (token shown once), rotate, revoke.
- views/top.ejs: "API Tokens" nav entry visible to all logged-in users.
- public/js/app.js: app.apiToken client module.
- DEPLOYMENT.md + docs/docker.md: API tokens section.

Co-authored-by: Claude <noreply@anthropic.com>

DEPLOYMENT.md

@@ -87,6 +87,34 @@ OpenResty-runtime / process env, not `app_*` config, so they stay in the compose
   proxies the UI under its own TLS)
 - Health: `http://127.0.0.1:3000/health` → `{"status":"ok"}`
 
+### API tokens (personal access tokens)
+
+Any logged-in user can mint a long-lived bearer token to call the management
+API from scripts/CI/other services, without an OIDC browser session. Tokens are
+self-service and authenticate **as their creator**: the creator's groups are
+snapshotted at mint time (mirroring how the proxy's browser session captures
+groups at login — the proxy never re-queries the IdP), and the existing authz
+layer (`Permission.effectiveFor` / `roles.resolveEffective`) applies unchanged.
+Local groups and owned-domain rights are recomputed live each request; only the
+SSO/LDAP group membership is the mint-time snapshot.
+
+Create one in the UI under **API Tokens** (the token string is shown **once**),
+then use it as a bearer token:
+
+```bash
+curl -H "Authorization: Bearer prx_<id>_<secret>" https://proxy.example.com/api/host
+```
+
+Format: `prx_<id>_<secret>` — the `id` is the lookup key, the `secret` is
+bcrypt-hashed and never stored in plaintext. Rotate or revoke from the same page
+(immediate effect). Optional expiry (in days) at creation. Tokens persist in the
+bundled Redis (AOF — see *Backups and restore*), so they survive rebuilds.
+
+The token carries the creator's effective rights: a global admin's token can
+manage Hosts/Users/Groups; a domain manager's token can manage their own
+domains but `requireAdmin` routes return 403. To tighten permissions after group
+changes, revoke and re-mint the token.
+
 ### OpenResty runtime env
 
 | Variable | Default | Description |