fix(api-tokens): harden scope enforcement and block sensitive endpoints (#228)

* fix(api-tokens): harden scope enforcement and add expiration support

- Fix deploy-only allowlist to match actual routes (deploy, down, restart,
  stop, start, update) instead of non-existent /up, /pull, /compose/* paths
- Block API tokens from auth-sensitive routes (password change, node token
  generation) that bypass scope enforcement middleware
- Add WebSocket scope enforcement: read-only/deploy-only tokens can only
  access logs and notifications, not host console or container exec
- Prevent API token self-replication: tokens cannot create, list, or revoke
  other tokens regardless of scope
- Map deploy-only tokens to admin role so they pass requireAdmin on deploy
  routes (scope middleware still restricts which endpoints they can reach)
- Add optional token expiration (30, 60, 90, 365 days or no expiry)
- Add token name length validation (max 100 characters)
- Surface fetchTokens errors in frontend instead of swallowing silently
- Fix docs: correct deploy-only scope description and GitHub Actions example

* fix(api-tokens): block all sensitive management endpoints from API tokens

User management, SSO configuration, node management, license management,
and console access are now human-session-only. Add comprehensive unit
tests for scope enforcement, blocked endpoints, expiration, and revocation.

* fix(api-tokens): fix TS18048 possibly-undefined in test

docs/features/api-tokens.mdx

@@ -17,15 +17,31 @@ Every token is created with one of three permission levels:
 |-------|----------------|
 | **Read Only** | `GET` requests only — view stacks, containers, metrics, and settings |
 | **Deploy Only** | Everything in Read Only, plus stack operations: deploy, down, restart, stop, start, update |
-| **Full Admin** | Unrestricted access — equivalent to an admin user session |
+| **Full Admin** | Full stack and container management — all read and write operations on stacks, containers, images, and system metrics |
 
 Choose the narrowest scope that fits your use case. A CI pipeline that only deploys stacks should use **Deploy Only**, not Full Admin.
 
+### Universal restrictions
+
+Regardless of scope, **all** API tokens are blocked from:
+
+| Category | Description |
+|----------|-------------|
+| **Password management** | Changing user passwords |
+| **User management** | Creating, updating, deleting, or listing user accounts |
+| **SSO configuration** | Viewing, creating, updating, deleting, or testing SSO providers |
+| **Node management** | Adding, updating, or deleting remote nodes |
+| **License management** | Activating or deactivating license keys |
+| **Token management** | Creating, listing, or revoking API tokens |
+| **Console access** | Generating console session tokens for interactive terminals |
+
+These restrictions ensure that API tokens cannot escalate privileges or modify the identity and infrastructure configuration of your Sencho instance. These operations require a human user session (browser login).
+
 ## Creating a token
 
 1. Open **Settings Hub** and navigate to the **API Tokens** tab (visible to Team Pro admins only).
 2. Click **Create Token**.
-3. Enter a descriptive name (e.g., "GitHub Actions deploy") and select a permission scope.
+3. Enter a descriptive name (e.g., "GitHub Actions deploy"), select a permission scope, and optionally choose an expiration period (30, 60, 90 days, or 1 year). Tokens without an expiration must be revoked manually.
 4. Click **Create**. The raw token is displayed **once** — copy it immediately.
 
 <Frame>