Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/ui.js

@@ -226,3 +226,11 @@ export function backLink(label, href) {
 export function safeBack(v) {
   return v && /^#\/[A-Za-z0-9\/?=&%._~+-]*$/.test(v) ? v : null;
 }
+
+// readOnly locks a form for someone who may look but not change: every
+// control is disabled, and the editors' add and remove buttons hidden.
+export function readOnly(el) {
+  for (const c of el.querySelectorAll("input, select, textarea")) c.disabled = true;
+  for (const b of el.querySelectorAll("button")) b.classList.add("hidden");
+  return el;
+}