ApiToken + mint/revoke + "Connect an agent" page

[CuriouslyCory]

Parent

PRD #2

What to build

A signed-in user can mint API tokens for agents and revoke them, from a "Connect an agent" page. Tokens are shown once and stored only as a hash (HMAC with a server-side pepper); a non-secret prefix is kept for display. Tokens carry scopes and an expiry.

Acceptance criteria

• ApiToken model stores a hashed token (unique), display prefix, scopes, expiry, and revocation; schema synced
• A user can mint a token (shown once) and revoke it from a "Connect an agent" page
• The raw token is never stored or logged; only its hash and prefix persist
• A server-side token pepper is added to the schema-validated environment (schema + runtime map)
• Service tests cover mint, hash-at-rest, and revoke
• pnpm check passes

Blocked by

• Project UI + empty Canvas island #4 (slice 2: Project UI + empty Canvas island)