Add API tokens, CLI server API and shared core crate

- Personal API tokens (full/read scope, expiry, revoke) and CLI password login
- Cargo workspace: codecraft-core (types, providers, permission rules) shared by
  server and the upcoming terminal client; server re-exports the old paths
- CLI server API: /cli/config, /cli/skill, /cli/tool (server MCP tools),
  /llm/stream model gateway with budgets and usage per user
- Theme/language preferences mirrored to the server; personal memory endpoint
- Statistics: provider and mode tables stacked; CLI usage labelled
- cli/: work in progress (terminal client is being rewritten as a local TUI)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/tools/mod.rs

@@ -54,6 +54,8 @@ pub struct ToolCtx {
     pub sandbox: Option<crate::sandbox::SandboxSpec>,
     /// Craft clean room active for this session (no page sources, no binaries).
     pub clean_room: bool,
+    /// User the call runs for when there is no session (CLI requests).
+    pub owner_id: Option<String>,
 }
 
 impl ToolCtx {
@@ -195,3 +197,16 @@ pub fn truncate(s: &str, max: usize) -> String {
     }
     format!("{}\n\n[... output truncated: {} of {} bytes shown ...]", &s[..cut], cut, s.len())
 }
+
+/// Server tools answer the permission rules' questions about themselves.
+impl codecraft_core::permission::ToolInfo for dyn Tool {
+    fn name(&self) -> &str {
+        Tool::name(self)
+    }
+    fn read_only(&self) -> bool {
+        Tool::read_only(self)
+    }
+    fn is_edit(&self) -> bool {
+        Tool::is_edit(self)
+    }
+}