docs(api-tokens): deep rewrite for v1, expand to fleet automation guide (#1140)

Rewrite docs/features/api-tokens.mdx (115 → 442 lines) as a full
product + technical guide: mental model, scope ladder, prerequisites,
step-by-step usage with HTTP/WS/multi-node examples, complete universal-
restriction table, cross-node proxy behaviour, lifecycle, rate-limit
ceiling, security model, limitations, three example workflows,
troubleshooting accordion, FAQ accordion.

Replace the single populated-list screenshot with five captured against
production: empty state, create form, reveal banner (token value
redacted), populated list with all three scope variants, revoke modal.

Sibling-doc edits keep tier statements coherent now that API tokens are
available on every tier:
- docs/api-reference/overview.mdx: drop the Admiral-only Note callout,
  drop API Tokens from the Admiral-gated license-tier table, correct
  the rate-limit table to say tokens are keyed per-credential
- docs/features/overview.mdx: drop the "Admiral only." sentence
- docs/security.mdx: drop "Admiral tier.", move API tokens row to every
  tier in the security matrix, repoint image to the new populated shot

docs/security.mdx

@@ -85,9 +85,9 @@ Every Sencho instance includes the foundational security stack. Advanced access-
 | Scan policies, scheduled scans, SBOM generation | | ✓ | ✓ |
 | Fleet Secrets (encrypted env-var bundles) | | ✓ | ✓ |
 | Webhook signatures (HMAC-SHA256) | | ✓ | ✓ |
+| API tokens (scoped, expiring) | ✓ | ✓ | ✓ |
 | Advanced RBAC (Deployer, Node Admin, Auditor) | | | ✓ |
 | Scoped permissions (per-stack, per-node) | | | ✓ |
-| API tokens (scoped, expiring) | | | ✓ |
 | Audit log with export | | | ✓ |
 
 ## Password authentication
@@ -161,10 +161,10 @@ Regardless of scope, tokens are universally blocked from sensitive operations: p
 Tokens are cryptographically hashed before storage; the raw value is shown exactly once at creation. Each token tracks its last-used timestamp for auditing. You can configure expiry at 30, 60, 90, or 365 days, or leave it open-ended. A maximum of 25 active tokens are allowed per user.
 
 <Frame>
-  <img src="/images/api-tokens/api-tokens-overview.png" alt="API tokens management showing active tokens with scope badges" />
+  <img src="/images/api-tokens/api-tokens-populated.png" alt="API tokens management showing active tokens with scope badges" />
 </Frame>
 
-For setup and usage, see [API Tokens](/features/api-tokens). Admiral tier.
+For setup and usage, see [API Tokens](/features/api-tokens).
 
 ## Webhook signature authentication