Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/permissions.md

@@ -7,7 +7,7 @@ else gets **grants**, `resource:access`:
 
 | Resource | read | write |
 |---|---|---|
-| `config` | settings, subnets, reservations, history, interfaces | change them, undo, import |
+| `config` | settings, subnets, reservations, history, interfaces (the web UI shows the forms locked) | change them, undo, import |
 | `leases` | leases and DHCP activity | delete a lease (making a reservation from one needs `config:write` too) |
 | `audit` | the audit log | – |
 | `*` | all of the above | |
@@ -38,7 +38,24 @@ steward token create backup-script --role leases --expires 365d
 ```
 
 The secret is shown once; only its hash is stored. A restricted token can
-only create tokens with a subset of its own grants. `steward token list`
+only create tokens with a subset of its own grants. The web UI only offers
+roles within what your account may do; a token with more would get no
+more than its user anyway.
+
+**Rotating** gives a token a new secret, keeping its ID, name and
+permissions, so only the programs that use it need updating:
+
+```sh
+steward token rotate 7 --grace 1h           # the old secret works for another hour
+steward token rotate --current --save       # this CLI's own token
+```
+
+A token that expires gets its lifetime again, from now (`--expires 90d`
+or `never` to change it). Without `--grace` the old secret stops at once:
+use that when it may have leaked. Using an old secret during its grace
+period is logged, naming the token and the address, so you can find the
+programs still to update. A restricted token may rotate itself and tokens
+no wider than itself. `steward token list`
 shows when each token was last used, and from where. `steward token revoke
 ID` stops one at once.