Add API tokens, CLI server API and shared core crate

- Personal API tokens (full/read scope, expiry, revoke) and CLI password login
- Cargo workspace: codecraft-core (types, providers, permission rules) shared by
  server and the upcoming terminal client; server re-exports the old paths
- CLI server API: /cli/config, /cli/skill, /cli/tool (server MCP tools),
  /llm/stream model gateway with budgets and usage per user
- Theme/language preferences mirrored to the server; personal memory endpoint
- Statistics: provider and mode tables stacked; CLI usage labelled
- cli/: work in progress (terminal client is being rewritten as a local TUI)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/api.rs

@@ -20,7 +20,7 @@ use serde_json::{Map, Value, json};
 use std::path::PathBuf;
 use std::sync::Arc;
 
-type AppState = Arc<App>;
+pub type AppState = Arc<App>;
 
 pub struct ApiError(pub StatusCode, pub String);
 
@@ -51,6 +51,7 @@ pub fn router(app: AppState) -> Router {
         // public
         .route("/info", get(auth::info))
         .route("/auth/login", post(auth::login))
+        .route("/auth/cli-login", post(auth::cli_login))
         .route("/auth/logout", post(auth::logout))
         .route("/auth/setup", post(auth::setup))
         .route("/auth/oidc/start", get(auth::oidc_start))
@@ -125,6 +126,14 @@ pub fn router(app: AppState) -> Router {
         .route("/images/{id}", delete(delete_image))
         .route("/images/{id}/file", get(image_file))
         .route("/account/git", get(get_git_settings).put(put_git_settings))
+        .route("/account/prefs", get(crate::cli_api::get_prefs).put(crate::cli_api::put_prefs))
+        .route("/account/memory", get(crate::cli_api::get_memory).put(crate::cli_api::put_memory))
+        .route("/cli/config", get(crate::cli_api::config))
+        .route("/cli/skill/{name}", get(crate::cli_api::skill))
+        .route("/cli/tool", post(crate::cli_api::tool))
+        .route("/llm/stream", post(crate::cli_api::llm_stream))
+        .route("/account/tokens", get(auth::list_api_tokens).post(auth::create_api_token))
+        .route("/account/tokens/{id}", delete(auth::delete_api_token))
         .route("/jobs", get(list_jobs).post(register_job))
         .route("/jobs/{id}", axum::routing::patch(update_job).delete(delete_job))
         .route("/jobs/{id}/run", post(run_job))