mrhid6
71f9a9dca5
Adds the approved design for personal access tokens on the control plane REST API, and for the generated OpenAPI 3.1 document served as a Scalar reference page. Tokens fall back into the existing session middleware rather than getting their own route group, so every handler, role guard and audit call works unchanged. Scope enforcement derives from the registered route pattern and fails closed, with a boot-time check for unmapped routes. A Terraform provider is deliberately left to a follow-on spec.