Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -136,6 +136,7 @@ see [kea.md](kea.md).
 | `whoami` | who you are to the server, and what you may do |
 | `user list\|add\|update\|delete` | users (administrators); `user add NAME --role operator` |
 | `token list [--all]`, `token create NAME [--role R] [--grant G]... [--expires 90d] [--user U] [--save]`, `token revoke ID` | API tokens |
+| `token rotate ID\|--current [--grace 1h] [--expires 90d\|never] [--save]` | a new secret for a token, the old one working for the grace period |
 | `password` | change your password |
 | `audit [--user U] [--action PREFIX] [--search TEXT]` | the audit log |
 | `config show`, `config set server\|token\|insecure\|ca_cert [VALUE]` | this CLI's settings |
@@ -150,7 +151,7 @@ The daemon's own commands work on the database directly, as root or the
 | Command | |
 |---|---|
 | `stewardd serve` | run (the systemd unit does) |
-| `stewardd init [-u NAME] [--token]` | create the database and the first administrator |
+| `stewardd init [-u NAME] [--token]` | create the database and the first administrator (asks for the name on a terminal) |
 | `stewardd user add NAME [--admin]`, `user password NAME`, `user token NAME TOKEN-NAME` | when the API can't be used |
 | `stewardd check` | check the configuration against this machine's interfaces |
 | `stewardd backup [FILE]`, `stewardd restore FILE` | [operations.md](operations.md) |