feat(api-tokens): make API tokens available on every tier (#1136)

API tokens are credential management, not a tier-gated capability. Remove
the Admiral gate from the POST/GET/DELETE handlers, drop the AdmiralGate
wrapper from the settings UI, set the registry entry's tier to null so the
tab renders on every tier, and update the docs Note to state availability
plainly.

The three permission scopes (read-only, deploy-only, full-admin), the
25-token-per-user cap, the per-token 200 req/min rate limit, the
sen_sk_ prefix format, and the SHA-256 hashed storage are all unchanged.

The Vitest suite now runs at Community tier to prove every code path works
without a paid license. A new "API token tier accessibility" describe block
mints all three scopes via POST /api/api-tokens to lock the behavior.

frontend/src/components/ApiTokensSection.tsx

@@ -9,7 +9,6 @@ import { ConfirmModal } from '@/components/ui/modal';
 import { toast } from '@/components/ui/toast-store';
 import { apiFetch } from '@/lib/api';
 import { copyToClipboard } from '@/lib/clipboard';
-import { AdmiralGate } from './AdmiralGate';
 import { CapabilityGate } from './CapabilityGate';
 import { Zap, Plus, Copy, Trash2, CheckCircle, RefreshCw, Clock } from 'lucide-react';
 import { SettingsPrimaryButton } from './settings/SettingsActions';
@@ -142,8 +141,7 @@ export function ApiTokensSection() {
     };
 
     return (
-        <AdmiralGate>
-          <CapabilityGate capability="api-tokens" featureName="API Tokens">
+        <CapabilityGate capability="api-tokens" featureName="API Tokens">
             <div className="space-y-6">
                 <div className="flex justify-end">
                     <SettingsPrimaryButton size="sm" onClick={() => setShowForm(!showForm)}>
@@ -291,7 +289,6 @@ export function ApiTokensSection() {
                     </p>
                 </ConfirmModal>
             </div>
-          </CapabilityGate>
-        </AdmiralGate>
+        </CapabilityGate>
     );
 }

frontend/src/components/settings/registry.ts

@@ -89,7 +89,7 @@ export const SETTINGS_ITEMS: readonly SettingsItemMeta[] = [
         label: 'API Tokens',
         description: 'Long-lived bearer tokens for CI and scripts.',
         keywords: ['bearer', 'automation', 'ci', 'scripts', 'scopes'],
-        tier: 'admiral',
+        tier: null,
         scope: 'global',
         adminOnly: true,
         hiddenOnRemote: true,