Make API auth mandatory, manage tokens via web UI

BREAKING CHANGE: API authentication is now always required. The
PINCHFLAT_API_TOKEN env var is no longer used. Instead, tokens are
stored in the database and managed via Settings → API Access.

Changes:
- Add api_token column to settings table (migration)
- ApiAuthPlug reads from DB; returns 401 if no token configured
- Add API Access section to Settings page with generate/regenerate/revoke
- Add POST /settings/generate_api_token and /settings/revoke_api_token
- Remove api_token from config.exs and runtime.exs
- Update all API controller tests to set auth token in setup
- Update auth plug tests for mandatory authentication
- 1008 tests pass, zero warnings

docs/API.md

@@ -5,22 +5,17 @@ MCP server integration and other automation use cases.
 
 ## API Authentication
 
-The API is protected by a Bearer token. Set the `PINCHFLAT_API_TOKEN`
-environment variable to a secure value:
+The API always requires a Bearer token — there is no open-access mode.
+Generate a token from the web UI under **Settings → API Access**:
 
-```bash
-docker run \
-  -e PINCHFLAT_API_TOKEN=your-secret-token \
-  ...
-```
-
-If the token is not set, API authentication is disabled (useful for
-development, but **not recommended for production**).
+1. Navigate to Settings
+2. Click "Generate API Token"
+3. Copy the token (it won't be shown in full again)
 
 Clients must send the token in the `Authorization` header:
 
 ```
-Authorization: Bearer your-secret-token
+Authorization: Bearer *** to regenerate or revoke the token at any time.
 ```
 
 ## API Endpoints