Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -187,6 +187,12 @@ CREATE TABLE audit (
 	detail TEXT NOT NULL DEFAULT ''
 );
 CREATE INDEX audit_time ON audit (time);
+`,
+	// 2: token rotation: a new secret, the old one working for a grace period.
+	`
+ALTER TABLE tokens ADD COLUMN rotated_at TEXT;
+ALTER TABLE tokens ADD COLUMN prev_secret_hash TEXT NOT NULL DEFAULT '';
+ALTER TABLE tokens ADD COLUMN prev_expires_at TEXT;
 `,
 }