Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/settings.js

@@ -1,6 +1,6 @@
 // Settings: the default lease time, conflict checks, authority, and the
 // options every subnet gets.
-import { h, mount, input, field, checkbox, errorBox } from "../ui.js";
+import { h, mount, input, field, checkbox, errorBox, readOnly } from "../ui.js";
 import { get, change, can } from "../api.js";
 import { optionsEditor, fmtSeconds, parseSeconds } from "../widgets.js";
 import { rerender } from "../app.js";
@@ -27,6 +27,7 @@ export async function render(el) {
     } catch (e) { mount(err, errorBox(e)); }
   };
   mount(el,
+    write ? null : h("div", { class: "msg info" }, "You can see the settings but not change them (that needs config:write)."),
     h("div", { class: "page-head" }, h("div", { class: "grow" }, h("h1", null, "Settings and options"),
       h("div", { class: "muted" }, "Server-wide settings, and the options every subnet sends. A subnet's or a reservation's own option of the same name wins."))),
     h("div", { class: "panel" },
@@ -40,4 +41,5 @@ export async function render(el) {
       write ? h("div", { class: "actions", style: { marginTop: "14px" } },
         h("button", { class: "primary", onclick: () => save(false) }, "Save"),
         h("button", { onclick: () => save(true), title: "Check without saving" }, "Check")) : null));
+  if (!write) readOnly(el.querySelector(".panel"));
 }