Add API tokens (PATs) support + bump submodules (#9)

Both submodules now support self-service personal access tokens (PATs) for
calling the management API without an OIDC browser session. Document the
feature in README.md + docs/ (mint under "API Tokens" in each UI, use as
`Authorization: Bearer sso_…` / `prx_…`, authenticates as the creator with
their permissions, rotate/revoke in the UI, persists in Redis via AOF).

Bump gitlinks to the merged submodule tips:
- sso-manager-node: 6920a9f -> b91ef27 (PR #35)
- proxy: 8e78604 -> a9a48c3 (PR #119)

Co-authored-by: Claude <noreply@anthropic.com>

README.md

@@ -176,6 +176,30 @@ full annotated shape, and each submodule's `secrets.js.example`.
   `cn=admin,<base>` (admin) or `cn=ldapclient,ou=people,<base>` (read-only
   service account the bootstrap created). Use LDAPS, not plain LDAP.
 
+### API tokens (personal access tokens)
+
+Both apps support **self-service personal access tokens** for calling their
+management APIs from scripts/CI/other services without an OIDC browser session.
+Each logged-in user mints their own tokens under **API Tokens** in the UI
+(the raw token is shown once); a token authenticates **as its creator** and
+carries their permissions. Revoke or rotate from the same page (immediate
+effect). Tokens persist in Redis (AOF) and survive rebuilds.
+
+```bash
+# SSO Manager — manage users/groups/OAuth clients from a script
+curl -H "Authorization: Bearer sso_<id>_<secret>" https://<SSO_HOST>/api/user
+
+# Proxy — manage Host records from a script
+curl -H "Authorization: Bearer prx_<id>_<secret>" https://<PROXY_HOST>/api/host
+```
+
+Format is `<prefix>_<id>_<secret>`; the `id` is the lookup key, the `secret` is
+bcrypt-hashed and never stored in plaintext. In the proxy, the creator's group
+membership is snapshotted at mint time (revoke + re-mint to tighten after group
+changes); the SSO re-resolves groups from LDAP live on each call. See each
+submodule's DEPLOYMENT (`sso-manager-node/DEPLOYMENT.md`, `proxy/DEPLOYMENT.md`)
+for details.
+
 ---
 
 ## Logs

docs/index.md

@@ -38,6 +38,11 @@ together, and [Standalone](standalone.html) for running each project on its own.
   with OIDC login.
 - **LDAPS** at `ldaps://<host>:636` — legacy apps can bind directly (admin or
   the read-only `cn=ldapclient` service account the bootstrap creates).
+- **API tokens** — both apps let any logged-in user mint self-service personal
+  access tokens (`Authorization: Bearer sso_…` / `prx_…`) to drive the management
+  API from scripts/CI without a browser session. A token authenticates as its
+  creator (carrying their permissions); mint/rotate/revoke under **API Tokens**
+  in each UI. See each submodule's DEPLOYMENT for the details.
 
 ## The `./config/` values you must set
 

docs/quickstart.md

@@ -142,6 +142,10 @@ docker compose exec sso-manager slapcat -f /etc/openldap/slapd.conf \
 
 - Add users / groups in the SSO UI.
 - Add Host records in the proxy UI to protect your apps with OIDC.
+- **Mint API tokens** to drive either app's management API from scripts/CI:
+  under **API Tokens** in each UI, mint a personal access token and use it as
+  `Authorization: Bearer sso_…` (SSO) or `prx_…` (proxy). A token authenticates as
+  its creator with their permissions. See each submodule's DEPLOYMENT.
 - See [Architecture](architecture.html) for how it all fits together, and
   [Standalone](standalone.html) to run either project on its own.