Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/users.js

@@ -1,5 +1,5 @@
 // Users and everyone's tokens (administrators).
-import { h, mount, table, time, modal, input, field, checkbox, select, errorBox, confirmDialog, toast, badge } from "../ui.js";
+import { h, mount, table, time, fmtTime, modal, input, field, checkbox, select, errorBox, confirmDialog, toast, badge, copyBox } from "../ui.js";
 import { get, api, catalog } from "../api.js";
 import { rerender } from "../app.js";
 
@@ -26,10 +26,46 @@ export async function render(el) {
       { label: "May", render: (t) => h("span", { class: "mono small" }, t.grant_strings.join(" ")) },
       { label: "Expires", render: (t) => t.expires_at ? time(t.expires_at) : "never" },
       { label: "Last used", render: (t) => t.last_used_at ? [time(t.last_used_at), h("span", { class: "muted small" }, " from " + t.last_used_ip)] : "never" },
-      { label: "", tdClass: "actions-cell", render: (t) => h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke") },
+      { label: "", tdClass: "actions-cell", render: (t) => [
+        h("button", { class: "small reveal", onclick: () => rotateDialog(t) }, "Rotate"), " ",
+        h("button", { class: "small reveal", onclick: () => revoke(t) }, "Revoke")] },
     ], tokens, { empty: "No tokens." })));
 }
 
+// rotateDialog gives a token a new secret. It keeps its name, ID and
+// permissions; only the programs that use it need the new secret.
+export async function rotateDialog(t) {
+  const grace = select([["", "stops working now"], ["10m", "keeps working for 10 minutes"], ["1h", "keeps working for 1 hour"], ["1d", "keeps working for 1 day"], ["7d", "keeps working for 7 days"]], "");
+  const expOpts = [["", t.expires_at ? "the same lifetime again, from now" : "never expires (as now)"], ["30d", "30 days from now"], ["90d", "90 days from now"], ["365d", "1 year from now"]];
+  if (t.expires_at) expOpts.push(["never", "never expires"]);
+  const exp = select(expOpts, "");
+  const err = h("div");
+  const box = h("div");
+  const go = h("button", { class: "primary", onclick: async () => {
+    mount(err);
+    const body = {};
+    if (grace.value) body.grace = grace.value;
+    if (exp.value === "never") body.no_expiry = true;
+    else if (exp.value) body.expires_in = exp.value;
+    go.disabled = true;
+    try {
+      const r = await api("POST", "/tokens/" + t.id + "/rotate", { body });
+      mount(box, h("div", { class: "msg ok" },
+        h("p", null, "New secret for " + t.name + ". Copy it now: it is not shown again."),
+        copyBox(r.secret),
+        h("p", { class: "small" }, r.previous_secret_valid_until ? ["The old secret keeps working until ", fmtTime(r.previous_secret_valid_until), "."] : "The old secret no longer works.")));
+      rerender();
+    } catch (ex) { go.disabled = false; mount(err, errorBox(ex)); }
+  } }, "Rotate");
+  mount(box,
+    h("p", null, "Gives ", h("strong", null, t.name), " a new secret. It keeps its name, ID and permissions, so only the programs that use it need updating."),
+    h("div", { class: "form-grid" },
+      field("Old secret", grace, "A grace period lets you update the programs without an outage. If the token may have leaked, let it stop now."),
+      field("Expires", exp)),
+    err, h("div", { class: "actions mt" }, go));
+  await modal("Rotate token " + t.name, box, [{ label: "Close", value: null }], { sticky: true });
+}
+
 export async function revoke(t) {
   if (!await confirmDialog("Revoke token", "Revoke " + t.username + "'s token “" + t.name + "”? Anything using it is refused from now on.", "Revoke", "danger")) return;
   try {