Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/account.js

@@ -1,8 +1,8 @@
 // Your account: password and API tokens.
 import { h, mount, table, time, modal, input, field, select, errorBox, toast, copyBox } from "../ui.js";
-import { get, api, state, catalog } from "../api.js";
+import { get, api, state, catalog, can } from "../api.js";
 import { rerender } from "../app.js";
-import { revoke } from "./users.js";
+import { revoke, rotateDialog } from "./users.js";
 
 export async function render(el) {
   const me = state.me;
@@ -36,13 +36,21 @@ export async function render(el) {
         { label: "May", render: (t) => h("span", { class: "mono small" }, t.grant_strings.join(" ")) },
         { label: "Expires", render: (t) => t.expires_at ? time(t.expires_at) : "never" },
         { label: "Last used", render: (t) => t.last_used_at ? time(t.last_used_at) : "never" },
-        { label: "", tdClass: "actions-cell", render: (t) => h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke") },
+        { label: "", tdClass: "actions-cell", render: (t) => [
+          h("button", { class: "small reveal", onclick: () => rotateDialog(t) }, "Rotate"), " ",
+          h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke")] },
       ], tokens, { empty: "No tokens." })));
 }
 
 async function newToken(cat) {
   const name = input({ placeholder: "laptop, backup script…" });
-  const role = select([["", "everything you may do"], ...Object.keys(cat.roles).map((r) => [r, r + ": " + cat.roles[r].join(" ")])], "");
+  // Only roles within what the user may do: a token can never do more
+  // than its user, so offering more would only mislead.
+  const roles = Object.keys(cat.roles).filter((r) => cat.roles[r].every((g) => {
+    const [res, acc] = g.split(":");
+    return can(res, acc === "write");
+  }));
+  const role = select([["", "everything you may do"], ...roles.map((r) => [r, r + ": " + cat.roles[r].join(" ")])], "");
   const expires = select([["", "never"], ["30d", "30 days"], ["90d", "90 days"], ["365d", "a year"]], "90d");
   const err = h("div");
   await modal("New API token", h("div", null, h("div", { class: "form-grid" }, field("Name", name), field("May do", role), field("Expires", expires)), err), [