New: personal access token management API (fixes #97)

[taylortom]

Fixes #97

Fixes #14

Fixes #95

Supersedes #96 — this branch includes and extends that scope-forwarding change, so #96 can be closed in favour of this PR.

New

• name, expiresAt and a masked hint on the authtoken schema.
• Personal access tokens are minted with an adpt_pat_<fragment>_ prefix and the full value is returned only once; the stored hint lets the owner recognise a token in a listing without exposing it. AuthToken.stripTokenPrefix() strips the prefix before verification, so session tokens (unprefixed) are unaffected.
• generateTokenHandler forwards name, lifespan and scopes to AuthToken.generate. lifespan: "never" mints a non-expiring token; otherwise expiresAt is persisted from the token's expiry.
• DELETE /tokens/:_id revokes a single token owned by the current user (ownership-scoped by _id + userId).
• A super user may now mint a manual token, provided they supply explicit scopes that don't include the super wildcard (*:*); minting without scopes, or with *:*, still returns SUPER_TOKEN_FORBIDDEN.

Fix

• GET /tokens no longer throws MODIFY_PROTECTED_ATTR (Fix /tokens API endpoint #14): the sanitise call now runs non-strict, so internal fields (e.g. signature) are stripped from the response rather than rejected. The listing also carries _id, is limited to personal (manual) tokens, and returns an empty array when there are none.
• Revoke-by-id used createObjectId(id), which ignores its argument and mints a new random id, so the query matched nothing. Switched to parseObjectId(id).

Testing

• Unit tests for resolveTokenScopes (super-lift cases), generateTokenHandler (name/lifespan/scopes forwarded; super no longer rejected outright), revokeTokenHandler (ownership-scoped, id parsed to an ObjectId) and stripTokenPrefix. Full suite (132) passes; standard clean.
• End-to-end against a running server: super mint with/without scopes and with *:*; prefixed Bearer authentication and scope limiting; sanitised listing with _id; per-token revoke actually removing the record; revoked token rejected; empty listing.

[github-actions]

🎉 This PR is included in version 2.9.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀