127c774590
Adds non-interactive API token authentication for external integrations: - SHA-256-hashed tokens with prefix, expiry, revocation, and last-used tracking - Bearer / X-API-Key header support; CSRF bypass for token-authenticated requests - Admin UI in Settings to create and revoke tokens (one-time plaintext display) - OpenAPI 3.0 spec served at /api/v1/openapi.json and /openapi.json - Migration #17: api_tokens table - Structured error logging in server/logger.js - Removed CDN-backed Swagger UI (hard constraint), reverted CSP - Translated all apiToken i18n keys to German Co-Authored-By: rafaelfoster <rafaelfoster@users.noreply.github.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>