feat: token lifecycle — named, scoped api tokens

[kacy]

adds named API tokens with scopes, TTL, and revocation, managed by a new
yoq token command. first half of the rbac item in next-steps.md; enforcement
in the dispatch path follows in a second pr.

summary

• new tokens table (migration): name, sha256(secret), scopes (csv), created,
  optional expiry, revocation. store helpers create/list/revoke and
  findActiveTokenByHash (filters revoked + expired). secrets are never stored.
• lib/scopes.zig: the permission vocabulary — <resource>:read|write, the *
  and <resource>:* wildcards, and write-implies-read — plus scope validation.
• yoq token create <name> --scope <s> [--scope ...] [--ttl 30d] generates a
  32-byte secret, stores its hash, and prints the secret once;
  yoq token list; yoq token revoke <name>. lifecycle ops are audited
  (token_create / token_revoke).
• backup validator updated to expect the new table.

tested

• YOQ_SKIP_SLOW_TESTS=1 zig build test — 2179 passed, 2 skipped, 0 failed.
• unit tests: store create/list/revoke + findActiveTokenByHash filtering
  expired and revoked rows, duplicate-name rejection; scope validation and
  allows (wildcards, write-implies-read, denials).
• ran the binary: create prints a one-time secret with its scopes; list shows
  status/scopes/expiry; duplicate name and invalid scope are rejected; revoke
  flips status to revoked.
• zig fmt --check clean.

follow-up

pr 2 wires enforcement into the api dispatch (per-route scope checks, 403 on
insufficient scope) and sets the audit actor to the token name. the existing
single api_token keeps working as full admin.