Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth.go

@@ -105,6 +105,13 @@ func NewToken() (token, publicID, secretHash string) {
 	return TokenPrefix + publicID + "_" + secret, publicID, HashSecret(secret)
 }
 
+// RotateToken makes a new token with an existing public ID (a rotated
+// token keeps its ID; only the secret changes).
+func RotateToken(publicID string) (token, secretHash string) {
+	secret := randomString(20)
+	return TokenPrefix + publicID + "_" + secret, HashSecret(secret)
+}
+
 // ParseToken splits a token into its public ID and secret.
 func ParseToken(token string) (publicID, secret string, err error) {
 	rest, ok := strings.CutPrefix(strings.TrimSpace(token), TokenPrefix)