Admin name at init, token rotation, read-only forms, token role presets

- stewardd init asks for the first administrator's name on a terminal.
- Tokens can be rotated (steward token rotate, POST /tokens/{id}/rotate,
  Rotate in the web UI), with a grace period for the old secret, as in
  Jarl. Schema migration 2 adds the token columns.
- Read-only users see the settings and a subnet's settings locked,
  instead of editable fields without a Save button.
- The New token dialog only offers roles within what the user may do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -185,6 +185,14 @@ run "a token" 0 test -n "$TOKEN"
 run "CLI over HTTP with the token" 0 "$WORK/steward" --config "$WORK/cli.yaml" --server http://$NA.2:8067 --token "$TOKEN" lease list
 contains "laptop"
 run "without a token: refused" 3 "$WORK/steward" --config "$WORK/cli.yaml" --server http://$NA.2:8067 --token steward_aaaaaaaaaaaaaaaa_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb status
+H="$WORK/steward --config $WORK/cli.yaml --server http://$NA.2:8067"
+NEW=$($H --token "$TOKEN" token rotate --current --grace 1h 2>/dev/null)
+run "rotate the CLI's own token" 0 test -n "$NEW"
+run "the new secret works" 0 $H --token "$NEW" whoami
+run "the old one too, during its grace period" 0 $H --token "$TOKEN" whoami
+NEWER=$($H --token "$NEW" token rotate --current 2>/dev/null)
+run "rotated without grace: the old secret stops" 3 $H --token "$NEW" whoami
+TOKEN=$NEWER
 LEASES=$(S token create readonly --user admin --role leases 2>/dev/null)
 run "a leases-only token can't change subnets" 3 "$WORK/steward" --config "$WORK/cli.yaml" --server http://$NA.2:8067 --token "$LEASES" subnet disable office
 run "delete a lease" 0 S lease delete $NA.101 --yes