Add API tokens (PATs) support + bump submodules (#9)

Both submodules now support self-service personal access tokens (PATs) for
calling the management API without an OIDC browser session. Document the
feature in README.md + docs/ (mint under "API Tokens" in each UI, use as
`Authorization: Bearer sso_…` / `prx_…`, authenticates as the creator with
their permissions, rotate/revoke in the UI, persists in Redis via AOF).

Bump gitlinks to the merged submodule tips:
- sso-manager-node: 6920a9f -> b91ef27 (PR #35)
- proxy: 8e78604 -> a9a48c3 (PR #119)

Co-authored-by: Claude <noreply@anthropic.com>

docs/index.md

@@ -38,6 +38,11 @@ together, and [Standalone](standalone.html) for running each project on its own.
   with OIDC login.
 - **LDAPS** at `ldaps://<host>:636` — legacy apps can bind directly (admin or
   the read-only `cn=ldapclient` service account the bootstrap creates).
+- **API tokens** — both apps let any logged-in user mint self-service personal
+  access tokens (`Authorization: Bearer sso_…` / `prx_…`) to drive the management
+  API from scripts/CI without a browser session. A token authenticates as its
+  creator (carrying their permissions); mint/rotate/revoke under **API Tokens**
+  in each UI. See each submodule's DEPLOYMENT for the details.
 
 ## The `./config/` values you must set
 

docs/quickstart.md

@@ -142,6 +142,10 @@ docker compose exec sso-manager slapcat -f /etc/openldap/slapd.conf \
 
 - Add users / groups in the SSO UI.
 - Add Host records in the proxy UI to protect your apps with OIDC.
+- **Mint API tokens** to drive either app's management API from scripts/CI:
+  under **API Tokens** in each UI, mint a personal access token and use it as
+  `Authorization: Bearer sso_…` (SSO) or `prx_…` (proxy). A token authenticates as
+  its creator with their permissions. See each submodule's DEPLOYMENT.
 - See [Architecture](architecture.html) for how it all fits together, and
   [Standalone](standalone.html) to run either project on its own.