feat: add API token authentication (closes #87)

- Add api_tokens table migration (007)
- Add APIToken model with CRUD operations
- Generate tokens with upaas_ prefix + 32 hex chars
- Store SHA-256 hash of tokens (not plaintext)
- Update APISessionAuth middleware to check Bearer tokens
- Add POST/GET/DELETE /api/v1/tokens endpoints
- Token creation returns plaintext once; list never exposes it
- Expired and revoked tokens are rejected
- Tests for creation, listing, deletion, bearer auth, revocation

internal/handlers/handlers_test.go

@@ -169,10 +169,11 @@ func setupTestHandlers(t *testing.T) *testContext {
 	require.NoError(t, handlerErr)
 
 	mw, mwErr := middleware.New(fx.Lifecycle(nil), middleware.Params{
-		Logger:  logInstance,
-		Globals: globalInstance,
-		Config:  cfg,
-		Auth:    authSvc,
+		Logger:   logInstance,
+		Globals:  globalInstance,
+		Config:   cfg,
+		Auth:     authSvc,
+		Database: dbInstance,
 	})
 	require.NoError(t, mwErr)