feat: restrict an api key to tagged servers from the create dialog

web/lib/api.ts

@@ -303,6 +303,9 @@ export type ApiToken = {
     last_used_at?: string | null;
     user_id: string;
     user_email?: string;
+    /** Restricts the token to servers carrying every pair. Absent or empty is
+     *  the whole fleet — the asymmetry is deliberate, see services.MatchesSelector. */
+    tag_selector?: Record<string, string> | null;
 };
 
 export interface SecretGroupSummary {
@@ -880,7 +883,13 @@ export const api = {
         return request<{ scopes: string[] }>("/tokens/scopes");
     },
 
-    createApiToken(body: { name: string; role: Role; scopes: string[]; expires_in_days?: number | null }): Promise<{ token: string; record: ApiToken }> {
+    createApiToken(body: {
+        name: string;
+        role: Role;
+        scopes: string[];
+        tag_selector?: Record<string, string>;
+        expires_in_days?: number | null;
+    }): Promise<{ token: string; record: ApiToken }> {
         return request<{ token: string; record: ApiToken }>("/tokens", {
             method: "POST",
             body: JSON.stringify(body),