Tokens that act as you.
Any user can create a personal API token with an optional expiry. The token is shown once; only its hash is stored. A request with the token is treated as that user, with the same roles, access filtering and audit entries.
- Shown once, stored as a hash
- Optional expiry
- Same RBAC and audit as the owner

