Make API auth mandatory, manage tokens via web UI

BREAKING CHANGE: API authentication is now always required. The
PINCHFLAT_API_TOKEN env var is no longer used. Instead, tokens are
stored in the database and managed via Settings → API Access.

Changes:
- Add api_token column to settings table (migration)
- ApiAuthPlug reads from DB; returns 401 if no token configured
- Add API Access section to Settings page with generate/regenerate/revoke
- Add POST /settings/generate_api_token and /settings/revoke_api_token
- Remove api_token from config.exs and runtime.exs
- Update all API controller tests to set auth token in setup
- Update auth plug tests for mandatory authentication
- 1008 tests pass, zero warnings

lib/pinchflat_web/controllers/settings/setting_controller.ex

@@ -28,6 +28,36 @@ defmodule PinchflatWeb.Settings.SettingController do
     render(conn, "app_info.html")
   end
 
+  def generate_api_token(conn, _params) do
+    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
+
+    case Settings.set(api_token: token) do
+      {:ok, _} ->
+        conn
+        |> put_flash(:info, "API token generated successfully.")
+        |> redirect(to: ~p"/settings")
+
+      {:error, _} ->
+        conn
+        |> put_flash(:error, "Failed to generate API token.")
+        |> redirect(to: ~p"/settings")
+    end
+  end
+
+  def revoke_api_token(conn, _params) do
+    case Settings.set(api_token: nil) do
+      {:ok, _} ->
+        conn
+        |> put_flash(:info, "API token revoked.")
+        |> redirect(to: ~p"/settings")
+
+      {:error, _} ->
+        conn
+        |> put_flash(:error, "Failed to revoke API token.")
+        |> redirect(to: ~p"/settings")
+    end
+  end
+
   def download_logs(conn, _params) do
     log_path = Application.get_env(:pinchflat, :log_path)
 

lib/pinchflat_web/controllers/settings/setting_html/setting_form.html.heex

@@ -26,6 +26,44 @@
     )}
   </section>
 
+  <section class="mt-8">
+    <h3 class="text-2xl text-black dark:text-white">
+      API Access
+    </h3>
+    <p class="text-sm mt-2 max-w-prose text-bodydark2">
+      Generate a token to authenticate requests to the <code class="font-mono">/api/v1</code> REST API.
+      Required for MCP server integration and other programmatic clients.
+      Send it as <code class="font-mono">Authorization: Bearer &lt;token&gt;</code>.
+    </p>
+
+    <div class="mt-4">
+      <%= if Settings.get!(:api_token) do %>
+        <div class="flex items-center gap-3 flex-wrap">
+          <code class="font-mono text-sm bg-meta-2 dark:bg-meta-4 px-3 py-2 rounded break-all">
+            {String.slice(Settings.get!(:api_token), 0, 12)}••••••••
+          </code>
+          <.link href={~p"/settings/generate_api_token"} method="post">
+            <.button rounding="rounded-lg" class="bg-warning hover:bg-warning/80">Regenerate Token</.button>
+          </.link>
+          <.link
+            href={~p"/settings/revoke_api_token"}
+            method="post"
+            data-confirm="Are you sure? This will immediately disable all API access."
+          >
+            <.button rounding="rounded-lg" class="bg-danger hover:bg-danger/80">Revoke Token</.button>
+          </.link>
+        </div>
+      <% else %>
+        <p class="text-sm text-danger mb-3">
+          No API token configured. The API is currently inaccessible.
+        </p>
+        <.link href={~p"/settings/generate_api_token"} method="post">
+          <.button rounding="rounded-lg" class="bg-primary hover:bg-primary/80">Generate API Token</.button>
+        </.link>
+      <% end %>
+    </div>
+  </section>
+
   <section class="mt-8">
     <section>
       <h3 class="text-2xl text-black dark:text-white">