Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/ui.js

@@ -49,12 +49,15 @@ export function fmtTime(iso) {
 
 export function relTime(iso) {
   if (!iso) return "";
-  const s = (Date.now() - new Date(iso).getTime()) / 1000;
+  const diff = (Date.now() - new Date(iso).getTime()) / 1000;
+  const s = Math.abs(diff);
   if (s < 60) return "just now";
-  if (s < 3600) return Math.floor(s / 60) + " min ago";
-  if (s < 86400) return Math.floor(s / 3600) + " h ago";
-  if (s < 86400 * 30) return Math.floor(s / 86400) + " days ago";
-  return fmtTime(iso);
+  let n;
+  if (s < 3600) n = Math.floor(s / 60) + " min";
+  else if (s < 86400) n = Math.floor(s / 3600) + " h";
+  else if (s < 86400 * 30) n = plural(Math.floor(s / 86400), "day");
+  else return fmtTime(iso);
+  return diff > 0 ? n + " ago" : "in " + n; // a future time (an expiry)
 }
 
 export function time(iso) {