Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -128,10 +128,11 @@ settings'.
 
 | | |
 |---|---|
-| `POST /auth/login`, `POST /auth/logout`, `GET /auth/whoami` | |
+| `POST /auth/login`, `POST /auth/logout`, `GET /auth/whoami` | `whoami` has `token_id` when the caller uses a token |
 | `POST /me/password` | `{"current", "password"}` |
 | `GET /me/tokens`, `POST /me/tokens` | `{"name", "role", "grants", "expires_in"}`; the answer's `secret` is shown once |
 | `GET /tokens`, `DELETE /tokens/{id}` | all tokens (administrators), revoke |
+| `POST /tokens/{id}/rotate` | a new secret: `{"grace": "1h", "expires_in": "90d", "no_expiry": false}`, all optional; answers with `secret` and `previous_secret_valid_until` |
 | `GET`, `POST /users`; `PATCH`, `DELETE /users/{id}` | administrators; `{"username", "password", "admin", "role", "grants", "disabled", "comment"}` |
 | `GET`, `POST /users/{id}/tokens` | |
 | `GET /audit[?user=&action=&result=&q=&before=&limit=]` | |

docs/cli.md

@@ -136,6 +136,7 @@ see [kea.md](kea.md).
 | `whoami` | who you are to the server, and what you may do |
 | `user list\|add\|update\|delete` | users (administrators); `user add NAME --role operator` |
 | `token list [--all]`, `token create NAME [--role R] [--grant G]... [--expires 90d] [--user U] [--save]`, `token revoke ID` | API tokens |
+| `token rotate ID\|--current [--grace 1h] [--expires 90d\|never] [--save]` | a new secret for a token, the old one working for the grace period |
 | `password` | change your password |
 | `audit [--user U] [--action PREFIX] [--search TEXT]` | the audit log |
 | `config show`, `config set server\|token\|insecure\|ca_cert [VALUE]` | this CLI's settings |
@@ -150,7 +151,7 @@ The daemon's own commands work on the database directly, as root or the
 | Command | |
 |---|---|
 | `stewardd serve` | run (the systemd unit does) |
-| `stewardd init [-u NAME] [--token]` | create the database and the first administrator |
+| `stewardd init [-u NAME] [--token]` | create the database and the first administrator (asks for the name on a terminal) |
 | `stewardd user add NAME [--admin]`, `user password NAME`, `user token NAME TOKEN-NAME` | when the API can't be used |
 | `stewardd check` | check the configuration against this machine's interfaces |
 | `stewardd backup [FILE]`, `stewardd restore FILE` | [operations.md](operations.md) |

docs/install.md

@@ -57,6 +57,10 @@ sudo chgrp steward /etc/steward /etc/steward/steward.yaml && sudo systemctl daem
    ```sh
    sudo -u steward stewardd init
    ```
+
+   It asks for the administrator's name (`admin` if you just press Enter;
+   your own name is better, since each person should have an account) and
+   password. `-u NAME` gives the name without asking.
 3. **Stop any other DHCP server** on the interfaces Steward will serve
    (Kea, isc-dhcp-server, dnsmasq): only one program can use an
    interface's port 67. Moving from Kea: [kea.md](kea.md).

docs/permissions.md

@@ -7,7 +7,7 @@ else gets **grants**, `resource:access`:
 
 | Resource | read | write |
 |---|---|---|
-| `config` | settings, subnets, reservations, history, interfaces | change them, undo, import |
+| `config` | settings, subnets, reservations, history, interfaces (the web UI shows the forms locked) | change them, undo, import |
 | `leases` | leases and DHCP activity | delete a lease (making a reservation from one needs `config:write` too) |
 | `audit` | the audit log | – |
 | `*` | all of the above | |
@@ -38,7 +38,24 @@ steward token create backup-script --role leases --expires 365d
 ```
 
 The secret is shown once; only its hash is stored. A restricted token can
-only create tokens with a subset of its own grants. `steward token list`
+only create tokens with a subset of its own grants. The web UI only offers
+roles within what your account may do; a token with more would get no
+more than its user anyway.
+
+**Rotating** gives a token a new secret, keeping its ID, name and
+permissions, so only the programs that use it need updating:
+
+```sh
+steward token rotate 7 --grace 1h           # the old secret works for another hour
+steward token rotate --current --save       # this CLI's own token
+```
+
+A token that expires gets its lifetime again, from now (`--expires 90d`
+or `never` to change it). Without `--grace` the old secret stops at once:
+use that when it may have leaked. Using an old secret during its grace
+period is logged, naming the token and the address, so you can find the
+programs still to update. A restricted token may rotate itself and tokens
+no wider than itself. `steward token list`
 shows when each token was last used, and from where. `steward token revoke
 ID` stops one at once.