Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -30,12 +30,14 @@ type ErrorInfo struct {
 
 // Whoami describes the caller.
 type Whoami struct {
-	User        *model.User   `json:"user"`
-	Admin       bool          `json:"admin"`
-	Method      string        `json:"method"`
-	Permissions []string      `json:"permissions"`
-	CSRFToken   string        `json:"csrf_token,omitempty"`
-	Build       version.Build `json:"build"`
+	User        *model.User `json:"user"`
+	Admin       bool        `json:"admin"`
+	Method      string      `json:"method"`
+	Permissions []string    `json:"permissions"`
+	// TokenID is the token the caller authenticated with (0: none).
+	TokenID   int64         `json:"token_id,omitempty"`
+	CSRFToken string        `json:"csrf_token,omitempty"`
+	Build     version.Build `json:"build"`
 }
 
 // Login is the login request.
@@ -184,6 +186,15 @@ type TokenInput struct {
 	ExpiresAt *time.Time `json:"expires_at,omitempty"`
 }
 
+// TokenRotation gives a token a new secret. Grace keeps the old secret
+// working for a while (up to 7d). The token gets its lifetime again,
+// counted from now, unless ExpiresIn or NoExpiry says otherwise.
+type TokenRotation struct {
+	Grace     string `json:"grace,omitempty"`
+	ExpiresIn string `json:"expires_in,omitempty"`
+	NoExpiry  bool   `json:"no_expiry,omitempty"`
+}
+
 // Token is a token; Secret is only set when it is created.
 type Token struct {
 	*model.Token