Users portlet: API Tokens tab

[hmoreras]

Goal

Deliver the API Tokens tab of the Edit User dialog.

Scope

• Tokens table: Token ID (truncated), Label, Issued, Expires, Requested By, Network CIDR chip, per-row Revoke
• Show inactive filter
• Request New Token action opens a sub-dialog:
  • Label
  • Expires Date (default ~3 years)
  • Allow Network CIDR (default 0.0.0.0/0)
• On successful creation, show the raw token once with a copy affordance
• Revoke prompts confirmation

Acceptance criteria

• Tokens list loads with correct fields
• Show inactive toggles revoked/expired token visibility
• New token creation returns and displays the raw token exactly once
• Copy affordance copies the raw token to clipboard
• Revoke removes the token from the active list
• Unit + integration tests via Spectator

QA

• Manual: create token, authenticate against /api/v1/users with it, revoke, verify 401
• Manual: CIDR restriction enforced (request from disallowed range returns 401)
• Manual: expired-only view via Show inactive

Design references

Interactive prototype: https://claude.ai/design/p/324a0e09-34dc-4925-a7fa-24f39fdafa54?via=share&file=Users.html

[github-actions]

PRs linked to this issue

• feat(users): API Tokens tab wired to real endpoints (#36720) by @AP2300