API tokens

Per-publisher publish credentials for agents and other sites.

Issue a scoped, show-once Bearer token to let an agent publish via the API and the brief CLI.

shell Token issue/list/revoke + scopes land in Phase 6.