Make API auth mandatory, manage tokens via web UI

BREAKING CHANGE: API authentication is now always required. The
PINCHFLAT_API_TOKEN env var is no longer used. Instead, tokens are
stored in the database and managed via Settings → API Access.

Changes:
- Add api_token column to settings table (migration)
- ApiAuthPlug reads from DB; returns 401 if no token configured
- Add API Access section to Settings page with generate/regenerate/revoke
- Add POST /settings/generate_api_token and /settings/revoke_api_token
- Remove api_token from config.exs and runtime.exs
- Update all API controller tests to set auth token in setup
- Update auth plug tests for mandatory authentication
- 1008 tests pass, zero warnings

test/pinchflat_web/api_auth_plug_test.exs

@@ -2,24 +2,34 @@ defmodule PinchflatWeb.ApiAuthPlugTest do
   use PinchflatWeb.ConnCase
 
   import Pinchflat.ProfilesFixtures
+  alias Pinchflat.Settings
 
   setup do
-    # Ensure api_token is not set by default in tests
-    Application.put_env(:pinchflat, :api_token, nil)
+    # Ensure api_token is cleared in DB for each test
+    Settings.set(api_token: nil)
     :ok
   end
 
   describe "when no api_token is configured" do
-    test "allows access without Authorization header", %{conn: conn} do
+    test "returns 401 without Authorization header", %{conn: conn} do
       conn = get(conn, ~p"/api/v1/media_profiles")
-      assert %{status: 200} = conn
+
+      assert %{status: 401} = conn
+    end
+
+    test "returns 401 even with a Bearer token", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("authorization", "Bearer some-token")
+        |> get(~p"/api/v1/media_profiles")
+
+      assert %{status: 401} = conn
     end
   end
 
   describe "when api_token is configured" do
     setup do
-      Application.put_env(:pinchflat, :api_token, "secret-token-123")
-      on_exit(fn -> Application.put_env(:pinchflat, :api_token, nil) end)
+      Settings.set(api_token: "secret-token-123")
       :ok
     end