feat(auth): add DB-based token authentication for dashboard-created clients

Add client_tokens table with auto-generated sk-{hex} tokens so clients
created in the dashboard get working API keys. Auth flow: DB token lookup
first, then env token fallback, then permissive mode. Includes token
management CRUD endpoints and copy-once reveal modal in the frontend.

Cargo.toml

@@ -52,6 +52,8 @@ futures = "0.3"
 async-trait = "0.1"
 async-stream = "0.3"
 reqwest-eventsource = "0.6"
+rand = "0.9"
+hex = "0.4"
 
 [dev-dependencies]
 tokio-test = "0.4"