fix: complete ORM port — token/oauth-client API mismatches, use published orm 0.2.8

- Use published @simpleworkjs/orm ^0.2.8 (fixes redis adapter write path)
  and model-redis ^1.6.0 instead of a local file: link that broke docker
  npm ci with a misleading "no lockfile" error.
- OtpToken.issue/verify: replace nonexistent find()/listDetail() with
  list({where}).
- routes/auth.js: ImpersonationToken.listDetail() -> list({where}).
- routes/token.js: drop listDetail() call; 404 on missing token instead
  of returning {results: null} with 200 (orm get() returns null, does
  not throw like model-redis Table.get did).
- OAuthClient: Resource has no is_valid column, so every client read as
  disabled and all /oauth/authorize requests 400'd — validity now lives
  in metadata (absent = valid). Also generate a unique slug on create
  (Resource.slug is required+unique) and use Resource.get() for lookup.
- User.login: 401 cleanly when neither uid nor username is supplied.
- models/index.js: log ORM init and surface init failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/models/index.js

@@ -23,13 +23,21 @@ async function initORM() {
   };
   ormConf.redis = conf.redis;
 
-  await init({
-    conf: { orm: ormConf },
-    models: [
-      Resource, ResourceEdge, ResourceGroup,
-      Token, AuthToken, InviteToken, ImpersonationToken, PasswordResetToken, OtpToken, ServiceToken
-    ]
-  });
+  console.log('[initORM] Starting ORM initialization...');
+  try {
+    await init({
+      conf: { orm: ormConf },
+      models: [
+        Resource, ResourceEdge, ResourceGroup,
+        Token, AuthToken, InviteToken, ImpersonationToken, PasswordResetToken, OtpToken, ServiceToken
+      ]
+    });
+    console.log('[initORM] ORM initialized successfully');
+    console.log('[initORM] Resource.orm =', !!Resource.orm, 'Token.orm =', !!Token.orm);
+  } catch (err) {
+    console.error('[initORM] ORM initialization failed:', err.message);
+    throw err;
+  }
 }
 
 module.exports.initORM = initORM;