Preserve destination on session-expiry login; compact the tokens table

The 401 interceptor (session expired) redirected to bare /login,
losing the page the user was on - the router guard already preserved
it but the expiry path bypassed the guard. The interceptor now carries
?redirect= like the guard does, and Login returns there.

The API tokens tables overflowed the card: the token column no longer
repeats the shopdb_pat_ prefix per row (short prefix shown, full form
on hover) - the token itself was already never displayed after
creation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/views/settings/ApiTokensList.vue

@@ -35,7 +35,7 @@
             <tbody>
               <tr v-for="token in myTokens" :key="token.tokenid">
                 <td>{{ token.name }}</td>
-                <td><code>{{ token.displayprefix }}...</code></td>
+                <td><code :title="token.displayprefix + '...'">{{ token.tokenprefix }}...</code></td>
                 <td><span class="badge" :class="scopeBadgeClass(token)">{{ scopeSummary(token) }}</span></td>
                 <td>{{ formatDate(token.createddate) }}</td>
                 <td>{{ token.expiresat ? formatDate(token.expiresat) : 'Never' }}</td>
@@ -84,7 +84,7 @@
             <tr v-for="token in allTokens" :key="token.tokenid">
               <td>{{ token.username || '-' }}</td>
               <td>{{ token.name }}</td>
-              <td><code>{{ token.displayprefix }}...</code></td>
+              <td><code :title="token.displayprefix + '...'">{{ token.tokenprefix }}...</code></td>
               <td><span class="badge" :class="scopeBadgeClass(token)">{{ scopeSummary(token) }}</span></td>
               <td>{{ token.expiresat ? formatDate(token.expiresat) : 'Never' }}</td>
               <td>{{ token.lastusedat ? formatDate(token.lastusedat) : 'Never' }}</td>