Add token rotation

jarl token rotate, a Rotate button in the web UI and
POST /api/v1/tokens/{id}/rotate give a token a new secret while it keeps
its ID, name, user and grants. The old secret stops at once or after a
grace period of up to 7 days, during which jarld logs who still uses it.
A token that expires gets its lifetime again. --save writes the new
secret where the CLI got the old one (its configuration or --token @FILE),
--write FILE to any file, and --current picks the token the CLI runs
with, so a restricted token can renew itself. A restricted token can't
rotate a wider token of its user.

Also fixes token create --save for named servers, and future times
(token expiry) shown as "just now" in the web UI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -241,6 +241,17 @@ run "acme unset when nothing there" 0 $J $ACME acme unset adbraun.test
 run "acme in unknown zone" 1 $J $ACME acme set example.org v
 run "token list --all" 0 $J token list --all
 contains "certbot-hook"
+cp $E/acme.token $E/acme.token.old
+run "acme token rotates itself (grace)" 0 $J $ACME token rotate --current --save --grace 1h
+run "rotated token works" 0 $J $ACME whoami
+run "old secret works during grace" 0 $J --token @$E/acme.token.old whoami
+run "rotate again without grace" 0 $J $ACME token rotate --current --save
+run "old secret refused after rotation (exit 3)" 3 $J --token @$E/acme.token.old whoami
+run "rotated token keeps its grants" 0 $J $ACME acme set adbraun.test rotated
+run "acme unset after rotation" 0 $J $ACME acme unset adbraun.test rotated
+run "acme token cannot rotate the admin's token (exit 4)" 4 $J $ACME token rotate 1
+run "token list shows rotation" 0 $J token list --user certbot
+contains "certbot-hook"
 TID=$($J token list --user certbot -o json | grep -o '"id": [0-9]*' | head -1 | grep -o '[0-9]*')
 run "token revoke" 0 $J token revoke $TID
 run "revoked token refused (exit 3)" 3 $J $ACME whoami