Replace the Schulcloud token without a restart

A token lasts 30 days and only a browser login yields one — the account is
federated, so the server cannot mint it. Replacing it meant editing .env and
recreating the container, every month.

`schulcloud token set` (a hidden prompt, or piped input) and a /token page
both send it to PUT /api/token. The server checks it with Schulcloud first —
well-formed, unexpired, still logged in, the same account — then swaps it
into the config every request reads, restarts the keepalive and saves it in
STATE_DIR, a new volume, with mode 0600. At startup the newer of the saved
token and TSC_JWT_COOKIE wins, unless they belong to different accounts. A
refused paste changes nothing, and the token is never logged.

The keepalive's pings carry a generation, so a 401 for the old token that
arrives after a swap cannot stop the new cycle. `schulcloud token`, whoami
and the log report the expiry and warn a week ahead.

Found on the way: a host that is off for more than two hours loses the
session however long the token has left — this machine lost it overnight —
which is what the always-on Pi is for.

174 tests. Smoke 72/72 on the local instance, and a real swap verified end to
end there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -77,10 +77,13 @@ schulcloud sync                # mirror coursework to ~/Schulcloud
 schulcloud refresh --course <id>
 schulcloud fs tree /courses    # browse the file manager ("Dateien")
 schulcloud fs get "/courses/<course>/<folder>"
+schulcloud token set           # the monthly chore: hand the Pi a fresh Schulcloud token
 ```
 
 It talks only to the Pi and holds no Schulcloud credential — see
-[docs/CLI.md](docs/CLI.md).
+[docs/CLI.md](docs/CLI.md). A fresh token can also be pasted into the server's
+`/token` page; either way the server checks it with Schulcloud and swaps it in
+without a restart.
 
 ## Quick start
 
@@ -174,9 +177,9 @@ npm run typecheck
 ```
 
 `npm run smoke` starts the HTTP server, connects a real MCP client over
-Streamable HTTP and exercises every tool against the live account — 67 checks (69 with the index)
+Streamable HTTP and exercises every tool against the live account — 72 checks (74 with the index)
 covering the auth gate, the protocol handshake, every content chain, file
-extraction, resources and prompts, `api_get`'s guard rails and error handling.
+extraction, resources and prompts, token replacement, `api_get`'s guard rails and error handling.
 
 ## Upstream