Add self-service API tokens (PATs) with UI + Bearer auth (#119)

Personal access tokens so scripts/CI can call the management API without an
OIDC browser session. Each logged-in user mints their own token; it
authenticates as the creator (groups snapshotted at mint, mirroring the proxy's
browser AuthToken), and the existing authz layer (Permission.effectiveFor /
roles.resolveEffective) applies unchanged. Local groups and owned-domain rights
are recomputed live; only SSO/LDAP group membership is the mint-time snapshot.

- models/api_token.js: new ApiToken model (prx_<id>_<secret> format; id is the
  lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/
  authenticate(); optional expires_at; best-effort last_used_on; groups
  snapshot. No _ttl (persists). Deliberately NOT wrapped in ModelPs (so the
  last_used_on write on the auth path doesn't spam the socket).
- routes/api_token.js: self-service CRUD (list/get/update/delete/rotate),
  owner-scoped (created_by === reqUsername(req), 403 otherwise).
- middleware/auth.js + models/auth.js: accept `Authorization: Bearer prx_...`
  (precedence over the auth-token session header). Builds a synthetic req.token
  that satisfies the only three req.token reads (auth.js .user/.groupsArray,
  authz.js reqUsername .created_by) so the authz layer works unchanged.
  checkApiToken collapses every failure to one generic 401 (no leak).
- views/api_tokens.ejs + routes/render.js (GET /api-tokens): self-service page
  (forceLogin, no admin gate) — create (token shown once), rotate, revoke.
- views/top.ejs: "API Tokens" nav entry visible to all logged-in users.
- public/js/app.js: app.apiToken client module.
- DEPLOYMENT.md + docs/docker.md: API tokens section.

Co-authored-by: Claude <noreply@anthropic.com>

nodejs/middleware/auth.js

@@ -4,6 +4,27 @@ const {Auth} = require('../models/auth');
 
 async function auth(req, res, next){
 	try{
+		// API-only token: `Authorization: Bearer prx_<id>_<secret>`. Takes
+		// precedence over the browser session header so scripts hit the same
+		// /api/* routes the UI uses. The synthetic req.token below satisfies the
+		// only req.token reads in the codebase: .user, .groupsArray(), .created_by
+		// (see middleware/authz.js reqUsername).
+		const authz = req.header('authorization') || '';
+		if(authz.slice(0, 7).toLowerCase() === 'bearer '){
+			const t = await Auth.checkApiToken(authz.slice(7));
+			req.token = {
+				user: {username: t.created_by},
+				created_by: t.created_by,
+				groupsArray: () => Array.isArray(t.groups) ? t.groups : [],
+				check: () => true,
+				is_valid: true,
+			};
+			req.user = req.token.user;
+			req.groups = req.token.groupsArray();
+			return next();
+		}
+
+		// Browser session: `auth-token: <AuthToken uuid>`.
 		req.token = await Auth.checkToken(req.header('auth-token'));
 		req.user = req.token.user;
 		// Session group memberships captured at login, used by authz middleware.