Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_users.go

@@ -200,6 +200,86 @@ func (s *Server) revokeToken(w http.ResponseWriter, r *http.Request, p *auth.Pri
 	return nil
 }
 
+// maxRotationGrace is the longest an old secret may keep working.
+const maxRotationGrace = 7 * 24 * time.Hour
+
+// rotateToken: POST /tokens/{id}/rotate gives a token a new secret. It
+// keeps its ID, name, user and grants, so only the programs that use it
+// need the new secret. The old secret stops at once, or after the grace
+// period. A token that expires gets its lifetime again, from now.
+func (s *Server) rotateToken(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
+	id, err := pathID(r, "id")
+	if err != nil {
+		return err
+	}
+	var in api.TokenRotation
+	if err := decodeOptional(r, &in); err != nil {
+		return err
+	}
+	t, err := s.store.GetToken(r.Context(), id)
+	if err != nil || t.UserID != p.User.ID && !p.IsAdmin() {
+		return notFound("token %d not found", id)
+	}
+	// A restricted token may rotate itself and tokens no wider than
+	// itself, but not a wider one: it would learn that token's secret.
+	if !p.IsAdmin() && p.Token != nil && p.Token.Grants != nil && p.Token.ID != t.ID && (t.Grants == nil || !auth.Narrower(t.Grants, p.Token.Grants)) {
+		return forbidden("a restricted token can only rotate itself and tokens with a subset of its own grants")
+	}
+	if t.RevokedAt != nil {
+		return conflict("token %d is revoked; make a new one", id)
+	}
+	now := time.Now()
+	var exp *time.Time
+	switch {
+	case in.ExpiresIn != "":
+		if in.NoExpiry {
+			return badRequest("no_expiry can't be combined with expires_in")
+		}
+		d, err := config.ParseDuration(in.ExpiresIn)
+		if err != nil || d <= 0 {
+			return badRequest("invalid expires_in %q (use e.g. 90d or 720h)", in.ExpiresIn)
+		}
+		e := now.Add(d)
+		exp = &e
+	case in.NoExpiry:
+	case t.ExpiresAt != nil:
+		if life := t.ExpiresAt.Sub(t.IssuedAt()); life > 0 {
+			e := now.Add(life)
+			exp = &e
+		}
+	}
+	var prevUntil *time.Time
+	if in.Grace != "" {
+		g, err := config.ParseDuration(in.Grace)
+		if err != nil || g < 0 || g > maxRotationGrace {
+			return badRequest("invalid grace %q: use a duration up to 7d, e.g. 30m, 24h or 2d", in.Grace)
+		}
+		until := now.Add(g)
+		if t.ExpiresAt != nil && t.ExpiresAt.Before(until) {
+			until = *t.ExpiresAt // the old secret never outlives its token
+		}
+		if g > 0 && until.After(now) {
+			prevUntil = &until
+		}
+	}
+	secret, hash := auth.RotateToken(t.PublicID)
+	if err := s.store.RotateToken(r.Context(), t.ID, hash, exp, prevUntil); err != nil {
+		return err
+	}
+	if t, err = s.store.GetToken(r.Context(), id); err != nil {
+		return err
+	}
+	detail := "the old secret stops now"
+	if prevUntil != nil {
+		detail = "the old secret works until " + prevUntil.UTC().Format(time.RFC3339)
+	}
+	s.eng.Audit(r.Context(), p, "token.rotate", "token "+t.Username+"/"+t.Name, "success", detail)
+	out := presentToken(t)
+	out.Secret = secret
+	writeJSON(w, http.StatusOK, out)
+	return nil
+}
+
 func presentUser(u *model.User) api.User {
 	return api.User{User: u, GrantStrings: grantStrings(u.Grants)}
 }