Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -37,8 +37,10 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   diff, and apply them together. Every applied changeset can be reverted.
   Serials are bumped automatically.
 * **Users and API tokens with granular permissions**, e.g. a token that may
-  only write `_acme-challenge` TXT records in one zone. Passwords use
-  argon2id, sessions have CSRF protection, logins are rate limited.
+  only write `_acme-challenge` TXT records in one zone. Tokens can be
+  rotated (a new secret, same grants), with an optional grace period.
+  Passwords use argon2id, sessions have CSRF protection, logins are rate
+  limited.
 * **Audit log** of every login, change and token, with user, token, IP and
   outcome.
 * **Query statistics** (optional, off by default): queries over time,