Replace the Schulcloud token without a restart

A token lasts 30 days and only a browser login yields one — the account is
federated, so the server cannot mint it. Replacing it meant editing .env and
recreating the container, every month.

`schulcloud token set` (a hidden prompt, or piped input) and a /token page
both send it to PUT /api/token. The server checks it with Schulcloud first —
well-formed, unexpired, still logged in, the same account — then swaps it
into the config every request reads, restarts the keepalive and saves it in
STATE_DIR, a new volume, with mode 0600. At startup the newer of the saved
token and TSC_JWT_COOKIE wins, unless they belong to different accounts. A
refused paste changes nothing, and the token is never logged.

The keepalive's pings carry a generation, so a 401 for the old token that
arrives after a swap cannot stop the new cycle. `schulcloud token`, whoami
and the log report the expiry and warn a week ahead.

Found on the way: a host that is off for more than two hours loses the
session however long the token has left — this machine lost it overnight —
which is what the always-on Pi is for.

174 tests. Smoke 72/72 on the local instance, and a real swap verified end to
end there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/CLI.md

@@ -54,6 +54,33 @@ file-manager folders included — so `refresh` starts it and then polls the
 server's status, printing a note every half minute, rather than holding one
 request open (which Node's fetch abandons after five minutes).
 
+### The server's Schulcloud token (`token`)
+
+```
+schulcloud token                   when it expires, and whether the session is alive
+schulcloud token set               hand the server a fresh one
+```
+
+The monthly chore, with no restart and no `.env` edit:
+
+1. Open a **private window** and log in to Schulcloud.
+2. DevTools → Application (Firefox: Storage) → Cookies → `jwt`: copy the value.
+3. `schulcloud token set` and paste it at the prompt. The input is hidden.
+4. **Close the private window.** Left open, it logs the token out about two
+   hours after login (docs/AUTH.md).
+
+Piping works too — `wl-paste | schulcloud token set` — and a pasted cookie
+line such as `jwt=…; Path=/` is cleaned up. The token is never a command-line
+argument, so it cannot end up in shell history.
+
+The server checks the token with Schulcloud before swapping it in, so a bad
+paste changes nothing. It refuses a token that is malformed, expired, already
+logged out, or for a different account. A replacement is saved on the server
+(`STATE_DIR`), so a restart keeps it, and the keepalive picks it up at once.
+The same form lives at `https://<server>/token` for when no terminal is at hand.
+The cookie is HttpOnly, so no bookmarklet can read it for you; the DevTools
+copy is the step that remains.
+
 ### The file manager (`fs`)
 
 The Schulcloud file manager ("Dateien") — Persönliche, Kurs-, Team- and