feat(users): API Tokens tab wired to real endpoints (#36720)

[AP2300]

Closes #36720

Depends on #36990 (Profile tab shell). This PR's diff currently includes the shell commits; once #36990 is merged to main, this branch will be rebased onto the new main and the diff will show only the API Tokens tab changes.

Summary

Ships the API Tokens tab wired against the modern ApiTokenResource (/api/v1/apitoken/*) — visual and behavioral parity with the legacy admin's token surface.

• List — GET /api/v1/apitoken/{userId}/tokens?showRevoked={bool} with a "Show revoked" toggle that mirrors the legacy checkbox.
• Create — a small sub-dialog collects Label + Expires Date + Allow Network, converts the date to `expirationSeconds`, POSTs to /api/v1/apitoken and returns {jwt, token}.
• Reveal — clicking a valid row opens a modal that calls GET /api/v1/apitoken/{id}/jwt. Backend mints a fresh signed JWT on every call ("Generates a new JWT for an existing token" / "overwrites the JWT value"), so re-revealing is safe by design — no exposure risk from a persisted token value.
• Revoke — PUT /api/v1/apitoken/{id}/revoke behind a p-confirmDialog. Row stays in the list for audit.
• Revoked / expired rows — muted (text-surface-400 opacity-60), non-clickable, action cell shows a small Revoked pill instead of a button.

Notable non-obvious calls

• Dropped legacy "Get Token" separate button. A single click on the row does the same thing.
• Dropped delete affordance for now — revoked rows show a static "Revoked" indicator only. The DELETE endpoint still exists; we can add a Delete button later if audits build up.
• Create-mode users see a hint, not the table. A userId is required to key any of the token endpoints.

Test plan

• Open an existing user with tokens — table lists them; toggling "Show revoked" refetches
• Click a valid row → reveal dialog opens, JWT lands, Copy button works
• Close and re-open the reveal → a fresh JWT string arrives (different signature)
• Request a new token → dialog closes, list refreshes with the new row, reveal dialog opens with the returned JWT
• Revoke a valid token → confirmation modal → on accept the row flips to muted "Revoked", becomes non-clickable
• Open the dialog in create mode → tab body renders the "save the user first" hint

🤖 Generated with Claude Code

[hmoreras]

statusOf distinguishes expired from revoked, but the template collapses both into the "Revoked" pill — a token that simply aged out shows up as Revoked, which isn't true. Worth a second branch (or deriving the label key from status) so expired rows say Expired; right now the 'expired' arm of TokenStatus never reaches the UI.

[hmoreras]

Hand-rolled <button> with a hardcoded text-red-500, while everything else in this file uses p-button — <p-button severity="danger" [text]="true" size="small"> gets the same look off the theme. Same for the pill just below: p-tag is what we use for read-only status elsewhere in the portlet, like the access chips in the list.

[hmoreras]

pi pi-spinner is PrimeIcons — the rest of this portlet is on Material Symbols (material-symbols-rounded in the list and the profile tab). progress_activity with animate-spin matches.

[hmoreras]

Revealing the JWT is the row's primary action but it's mouse-only — the <tr> isn't focusable and there's no key handler, with title as the only hint. Since the separate Reveal button was dropped in favour of the row click, this is now the only path to the JWT, so keyboard users have none.

[hmoreras]

A failed fetch leaves tokens empty, so a 500 renders as "No active tokens." and the toast is the only sign something broke. The copy is also off when Show inactive is checked and there really are no tokens — it isn't only active ones being listed at that point.

[hmoreras]

generateApiToken only signs — it doesn't touch the record or invalidate anything, so every JWT previously minted for this token stays valid until it's revoked or expires. "Supersedes any previously-issued one" reads like rotation, which could leave someone thinking a re-reveal kills a leaked JWT. Revoke is the only thing that does.

[hmoreras]

?? '' turns a malformed response into an empty string, and the reveal dialog treats '' as falsy — so the spinner sits there forever instead of surfacing anything. Letting it come through as null and handling it in the error path would at least fail visibly.

[hmoreras]

deleteApiToken isn't called anywhere (only mocked in a spec), and the comment describes a guard the UI mirrors even though there's no Delete affordance — worth dropping until the button lands, or leaving a TODO.

While you're in here: dot-users.service.spec.ts covers the filter and delete-user URLs but none of the five new token methods. The showRevoked param and the two response-envelope unwraps would be cheap to pin.

[hmoreras]

Same decorator/naming notes as the tab (changeDetection, standalone, $ on the signals, # on the deps). No spec for this dialog either — the required-field validation, the past guard and the close-with-result path are the interesting bits.

[hmoreras]

defaultExpiryDate emits YYYY-MM-DD, and new Date('2029-08-19') parses as UTC midnight while Date.now() is local — so the TTL is off by the browser's offset and the token expires at UTC midnight of the chosen date, which is the previous evening for anyone west of UTC. It also means picking today's date gets rejected as past in those timezones. Harmless at the three-year default; building the Date from the parts keeps it local.