Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -80,8 +80,12 @@ and a CLI, built the way Jarl is.
   - It lists what it doesn't support instead of dropping it silently.
   - Importing again keeps subnets' and reservations' IDs and Steward's
     subnet names.
-- **`stewardd`** commands: `init`, `user add|password|token`, `check`,
-  `backup` (with pruning), `restore`, `config --example`.
+- **`stewardd`** commands: `init` (asks for the administrator's name),
+  `user add|password|token`, `check`, `backup` (with pruning), `restore`,
+  `config --example`.
+- **Token rotation** (`steward token rotate`, `POST /tokens/{id}/rotate`,
+  Rotate in the web UI): a new secret for a token, with an optional grace
+  period for the old one, as in Jarl.
 - **Packaging:**
   - a sandboxed systemd unit (`steward.service`, also `stewardd.service`)
     whose only privilege is `CAP_NET_BIND_SERVICE`;