Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -191,6 +191,20 @@ type TokenInput struct {
 	ExpiresAt    *time.Time     `json:"expires_at,omitempty"`
 }
 
+// TokenRotation gives a token a new secret (POST /tokens/{id}/rotate).
+// Every field is optional.
+type TokenRotation struct {
+	// Grace keeps the old secret working this long (e.g. "1h", "2d"; at
+	// most 7d), so clients can be updated without an outage. Default:
+	// the old secret stops at once.
+	Grace string `json:"grace,omitempty"`
+	// The new expiry. Default: a token that expires gets its lifetime
+	// again, counted from now; one that doesn't, still doesn't.
+	ExpiresIn string     `json:"expires_in,omitempty"`
+	ExpiresAt *time.Time `json:"expires_at,omitempty"`
+	NoExpiry  bool       `json:"no_expiry,omitempty"`
+}
+
 // ZoneImport imports zone file text into a zone.
 type ZoneImport struct {
 	Text string `json:"text"`