Add personal API tokens; wire measuring tools into remaining surfaces

API tokens: any user mints named, optionally-expiring tokens
(shopdb_pat_..., sha256-stored, secret shown once) at Settings > API
Tokens; a before-request shim swaps a valid PAT for a request-scoped
JWT of its owner, so the entire existing auth/authz/import-mode stack
works unchanged and revoked/expired tokens 401 cleanly. Built for
long-running scripts - the legacy import no longer dies when a login
JWT expires. Migration 7d21_apitokens; create/revoke audit-logged.

Audited integration gaps fixed: Asset.to_dict serializes measuring
tools (typedata + pluginid - relationship links to tools resolve); map
subtype filter/colors and MapEditor include them; dashboard totals
count them; warranty links use a new by-asset route; the measuringtools
ADR-010 hooks are real (corrected presentation token, implemented
map-overlay endpoint); the login avatar resolves through the
employee-photo helper.

737 tests pass; naming green; frontend builds; both features verified
live end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -12,6 +12,23 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- Personal API tokens (PATs) so scripts and integrations authenticate without
+  the hourly-expiring login JWT (immediate consumer: long legacy-import runs
+  that die when the JWT expires mid-run). New core `apitokens` table + migration
+  `7d21_apitokens` (stores only the sha256 hash of each secret; the full secret
+  `shopdb_pat_<40 hex>` is shown ONCE at creation). New core blueprint
+  `/api/apitokens` (list own / admin `?all=true`; create; rename or deactivate;
+  revoke). A `Bearer shopdb_pat_...` header is recognized before any JWT decode
+  by a before_request shim that mints a request-scoped JWT for the token's
+  owner, so the entire existing auth+authz stack (jwt_required,
+  require_permission, require_role, import mode, current_user) authenticates the
+  PAT as its owner with zero decorator changes; an invalid, revoked, or expired
+  PAT gets a clean 401. `lastusedat` is stamped on use (throttled to at most one
+  write per 60s). Any authenticated user manages their own tokens; admins may
+  list or revoke anyone's. New Settings > API Tokens page (`ApiTokensList.vue`)
+  with a create modal that reveals the secret once (copy button) and an admin
+  All Tokens section. Docs: `docs/IMPORT-API.md` and `docs/CONFIG.md` updated to
+  recommend a PAT for imports. Core feature; no plugin-contract change.
 - Vendor-model photos on asset detail heroes: computers and printers now
   surface the linked model's `imageurl` in their extension payloads (the
   field machines already exposed), and the machine, PC, printer, network