fix(api-tokens): harden with security fixes, design compliance, and test coverage (#567)

Security: add JWT-level expiry ceiling (400d), per-user token count limit (25),
and token name uniqueness enforcement. Fix async clipboard copy.

Design: migrate Select to Combobox, apply card bevel styling, fix icon
strokeWidth, add tabular-nums to timestamps, fix destructive button pattern.

Tests: expand from ~20 to 47 test cases covering creation validation, token
limits, name uniqueness, last_used_at tracking, ownership constraints, delete
edge cases, and registry blocked endpoints.

Docs: update API Tokens docs with token limits, name uniqueness, registry
restrictions, and JWT expiry ceiling. Update OpenAPI spec with 409 response.

backend/src/__tests__/helpers/setupTestDb.ts

@@ -40,6 +40,19 @@ export async function setupTestDb(): Promise<string> {
   return tmpDir;
 }
 
+/**
+ * Log in as the seeded test admin and return the session cookie string.
+ * Requires `app` to be the Express instance from `index.ts`.
+ */
+export async function loginAsTestAdmin(app: import('express').Express): Promise<string> {
+  const supertest = (await import('supertest')).default;
+  const res = await supertest(app)
+    .post('/api/auth/login')
+    .send({ username: TEST_USERNAME, password: TEST_PASSWORD });
+  const cookies = res.headers['set-cookie'] as string | string[];
+  return Array.isArray(cookies) ? cookies[0] : cookies;
+}
+
 export function cleanupTestDb(tmpDir: string): void {
   try {
     fs.rmSync(tmpDir, { recursive: true, force: true });