feat(files): API tokens in Settings, the Hub folder in Files, a notice before a token runs out

Settings gains an API tokens tab: a row per token (name and prefix; each
folder with its rights; last use and expiry, "expires soon" marked),
revoked from its menu behind a confirm. A new token is the Hub exchange in
one click, or folders and rights picked per folder (no Write where an
upload cannot land); expiry 30/90 days, 1 year or never (warned). The
token shows once in the same dialog, with Copy and a ready curl line.

The Hub folder closes the Sources in the Files rail, takes uploads and
moved-in files. A token about to run out warns its user once, a week
before (the Files GC's sixth pass); the notice opens the tokens tab.

frontend/src/lib/api.ts

@@ -63,6 +63,9 @@ export type * from "./api/downloads";
 import { filesApi } from "./api/files";
 export type * from "./api/files";
 export { FILES_LIST_CAP, FILE_SORTS } from "./api/files";
+import { tokensApi } from "./api/tokens";
+export type * from "./api/tokens";
+export { TOKEN_EXPIRY_DAYS, TOKEN_EXPIRY_DEFAULT, TOKEN_RIGHTS } from "./api/tokens";
 import { debugSessionsApi, diagnosticsApi } from "./api/diagnostics";
 export type * from "./api/diagnostics";
 export { DIAGNOSTICS_EVENTS_PATH } from "./api/diagnostics";
@@ -84,6 +87,7 @@ export const api = {
   ...plexApi,
   ...downloadsApi,
   ...filesApi,
+  ...tokensApi,
   ...diagnosticsApi,
   ...debugSessionsApi,
 };