feat(files): API tokens in Settings, the Hub folder in Files, a notice before a token runs out

Settings gains an API tokens tab: a row per token (name and prefix; each
folder with its rights; last use and expiry, "expires soon" marked),
revoked from its menu behind a confirm. A new token is the Hub exchange in
one click, or folders and rights picked per folder (no Write where an
upload cannot land); expiry 30/90 days, 1 year or never (warned). The
token shows once in the same dialog, with Copy and a ready curl line.

The Hub folder closes the Sources in the Files rail, takes uploads and
moved-in files. A token about to run out warns its user once, a week
before (the Files GC's sixth pass); the notice opens the tokens tab.

frontend/src/lib/settingsTab.ts

@@ -0,0 +1,16 @@
+import { LS, setTabRaw } from "./storage";
+
+// The Settings page's tabs, and a helper to pre-select one before navigating there (a notice's link,
+// a return from Google). useTabPersistedState reads the key when the page mounts, and the page mounts
+// fresh on navigation. Kept out of SettingsPanel.tsx so a caller does not pull the page in with it.
+export type SettingsTabId =
+  | "appearance"
+  | "notifications"
+  | "downloads"
+  | "tokens"
+  | "account"
+  | "diagnostics";
+
+export function focusSettingsTab(tab: SettingsTabId): void {
+  setTabRaw(LS.settingsTab, tab);
+}