Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -24,6 +24,15 @@ The first version, to be released as 0.1.0.
   the web UI. Networks smaller than a /24 explain that they belong in the
   enclosing /24's zone.
 - docs/operations.md: setting up a secondary server with its own jarld.
+- Token rotation: `jarl token rotate`, the Rotate button in the web UI and
+  `POST /api/v1/tokens/{id}/rotate` give a token a new secret while it
+  keeps its ID, name, user and grants. The old secret stops at once or after
+  a grace period of up to 7 days (`--grace`), during which jarld logs who
+  still uses it. A token that expires gets its lifetime again. `--save`
+  writes the new secret where the CLI got the old one (its configuration or
+  `--token @FILE`), `--write FILE` to any file, and `--current` picks the
+  token the CLI runs with, so a restricted token can renew itself.
+  `jarl token list` shows when a token was last rotated.
 - An endpoint for lego's `httpreq` DNS provider
   (`/api/v1/acme/httpreq/present` and `/cleanup`), so lego and Traefik can
   publish DNS-01 challenges with only environment variables, without the
@@ -183,6 +192,11 @@ The first version, to be released as 0.1.0.
 
 ### Fixed
 
+- `jarl token create --save` stored the token at the top level of the
+  CLI configuration even when a named server was selected; it now goes into
+  that server's entry.
+- The web UI showed future times, such as token expiry dates, as "just
+  now"; they now read "in 29 days".
 - The dashboard's "Pending changes (1 open)" counted empty changesets (and
   other users'), so the Changes page then showed none. It now counts your
   own changesets that contain changes, and the status API's