Add API tokens, CLI server API and shared core crate

- Personal API tokens (full/read scope, expiry, revoke) and CLI password login
- Cargo workspace: codecraft-core (types, providers, permission rules) shared by
  server and the upcoming terminal client; server re-exports the old paths
- CLI server API: /cli/config, /cli/skill, /cli/tool (server MCP tools),
  /llm/stream model gateway with budgets and usage per user
- Theme/language preferences mirrored to the server; personal memory endpoint
- Statistics: provider and mode tables stacked; CLI usage labelled
- cli/: work in progress (terminal client is being rewritten as a local TUI)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/mentions.rs

@@ -43,6 +43,7 @@ pub async fn expand(app: &Arc<App>, session_id: &str, text: &str) -> Vec<Part> {
         roots: app.user_roots(session.owner_id.as_deref()),
         sandbox: crate::sandbox::spec_for(app, session.owner_id.as_deref()),
         clean_room: session.clean_room(app.config().craft.clean_room),
+        owner_id: None,
     };
     let mut parts = Vec::new();
     for token in tokens.into_iter().take(MAX_MENTIONS) {