feat: bot API token management page

The account page pointed users at a "bot-token list" that didn't exist: there
was no GET endpoint, no UI route, and the client type lacked expiry. Add
GET /v1/auth/tokens (caller-scoped, token_hash never serialised), extend the
auth client with listTokens/expires_at and createToken expiry, and add a
/profile/tokens page to list, create (revealing the raw bearer once), and
revoke tokens. Link the account-page copy to it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/lib/api/auth.ts

@@ -92,15 +92,29 @@ export type ApiToken = {
     name: string;
     created_at: string;
     last_used_at: string | null;
+    /** When the token stops authenticating; `null` = never expires. */
+    expires_at: string | null;
 };
 
 export type CreatedToken = ApiToken & { bearer: string };
 
-export async function createToken(name: string): Promise<CreatedToken> {
+/** The caller's bot tokens, newest first (metadata only — the raw bearer is
+ *  shown once at creation and never returned again). */
+export async function listTokens(): Promise<ApiToken[]> {
+    const res = await request<{ items: ApiToken[] }>('/v1/auth/tokens');
+    return res.items;
+}
+
+export async function createToken(
+    name: string,
+    expiresInDays?: number
+): Promise<CreatedToken> {
+    const payload: { name: string; expires_in_days?: number } = { name };
+    if (expiresInDays !== undefined) payload.expires_in_days = expiresInDays;
     return request<CreatedToken>('/v1/auth/tokens', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ name })
+        body: JSON.stringify(payload)
     });
 }