Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/models/models_api_token.go

@@ -0,0 +1,49 @@
+package models
+
+import "time"
+
+// =========================================
+// API TOKENS (Personal Access Tokens)
+// =========================================
+
+// APIToken represents a personal access token for programmatic API access.
+// The token_hash stores the SHA-256 hash of the raw token string.
+// The raw token is only shown once at creation time.
+type APIToken struct {
+	ID          string     `json:"id" db:"id"`
+	UserID      string     `json:"user_id" db:"user_id"`
+	Name        string     `json:"name" db:"name"`
+	TokenHash   string     `json:"-" db:"token_hash"` // never exposed via JSON
+	Prefix      string     `json:"prefix" db:"prefix"` // first 8 hex chars for identification
+	Permissions []string   `json:"permissions" db:"-"`  // resolved from JSON column
+	ExpiresAt   *time.Time `json:"expires_at,omitempty" db:"expires_at"`
+	LastUsedAt  *time.Time `json:"last_used_at,omitempty" db:"last_used_at"`
+	CreatedAt   time.Time  `json:"created_at" db:"created_at"`
+	CreatedBy   *string    `json:"created_by,omitempty" db:"created_by"`
+}
+
+// APITokenCreateRequest is the JSON body for token creation.
+type APITokenCreateRequest struct {
+	Name        string   `json:"name"`
+	Permissions []string `json:"permissions"`
+	ExpiresAt   string   `json:"expires_at,omitempty"` // ISO 8601
+}
+
+// AdminTokenCreateRequest extends the create request with a target user.
+type AdminTokenCreateRequest struct {
+	UserID      string   `json:"user_id"`
+	Name        string   `json:"name"`
+	Permissions []string `json:"permissions"`
+	ExpiresAt   string   `json:"expires_at,omitempty"`
+}
+
+// APITokenCreateResponse includes the raw token (shown once).
+type APITokenCreateResponse struct {
+	Token       string     `json:"token"` // raw token, shown once
+	ID          string     `json:"id"`
+	Name        string     `json:"name"`
+	Prefix      string     `json:"prefix"`
+	Permissions []string   `json:"permissions"`
+	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
+	CreatedAt   time.Time  `json:"created_at"`
+}