Make API auth mandatory, manage tokens via web UI

BREAKING CHANGE: API authentication is now always required. The
PINCHFLAT_API_TOKEN env var is no longer used. Instead, tokens are
stored in the database and managed via Settings → API Access.

Changes:
- Add api_token column to settings table (migration)
- ApiAuthPlug reads from DB; returns 401 if no token configured
- Add API Access section to Settings page with generate/regenerate/revoke
- Add POST /settings/generate_api_token and /settings/revoke_api_token
- Remove api_token from config.exs and runtime.exs
- Update all API controller tests to set auth token in setup
- Update auth plug tests for mandatory authentication
- 1008 tests pass, zero warnings

test/pinchflat_web/controllers/api/v1/api_media_item_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiMediaItemControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.MediaFixtures
   import Pinchflat.SourcesFixtures
   import Pinchflat.ProfilesFixtures

test/pinchflat_web/controllers/api/v1/api_media_profile_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiMediaProfileControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.ProfilesFixtures
 
   describe "GET /api/v1/media_profiles" do

test/pinchflat_web/controllers/api/v1/api_setting_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiSettingControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.ProfilesFixtures
 
   alias Pinchflat.Settings

test/pinchflat_web/controllers/api/v1/api_source_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiSourceControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.MediaFixtures
   import Pinchflat.SourcesFixtures
   import Pinchflat.ProfilesFixtures

test/pinchflat_web/controllers/api/v1/api_task_controller_test.exs

@@ -1,6 +1,16 @@
 defmodule PinchflatWeb.Api.V1.ApiTaskControllerTest do
   use PinchflatWeb.ConnCase
 
+  setup do
+    Pinchflat.Settings.set(api_token: "test-token")
+
+    conn =
+      build_conn()
+      |> put_req_header("authorization", "Bearer test-token")
+
+    {:ok, conn: conn}
+  end
+
   import Pinchflat.SourcesFixtures
   import Pinchflat.MediaFixtures