Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth.go

@@ -108,6 +108,12 @@ func NewToken() (token, publicID, secretHash string) {
 	return TokenPrefix + publicID + "_" + secret, publicID, HashSecret(secret)
 }
 
+// RotateToken makes a new secret for a token's public ID.
+func RotateToken(publicID string) (token, secretHash string) {
+	secret := RandomString(20)
+	return TokenPrefix + publicID + "_" + secret, HashSecret(secret)
+}
+
 // ParseToken splits a token into its public ID and secret.
 func ParseToken(token string) (publicID, secret string, err error) {
 	rest, ok := strings.CutPrefix(strings.TrimSpace(token), TokenPrefix)