Add API tokens, CLI server API and shared core crate

- Personal API tokens (full/read scope, expiry, revoke) and CLI password login
- Cargo workspace: codecraft-core (types, providers, permission rules) shared by
  server and the upcoming terminal client; server re-exports the old paths
- CLI server API: /cli/config, /cli/skill, /cli/tool (server MCP tools),
  /llm/stream model gateway with budgets and usage per user
- Theme/language preferences mirrored to the server; personal memory endpoint
- Statistics: provider and mode tables stacked; CLI usage labelled
- cli/: work in progress (terminal client is being rewritten as a local TUI)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/i18n/de.ts

@@ -370,6 +370,24 @@ export const de: Messages = {
   "voice.stop": "Diktat beenden",
   "voice.denied": "Mikrofonzugriff verweigert – in den Browser-Einstellungen erlauben.",
   "voice.error": "Spracherkennung fehlgeschlagen",
+  "tokens.title": "API-Tokens",
+  "tokens.hint": "Für den Kommandozeilen-Client (codecraft) und Skripte: als „Authorization: Bearer <token>“ mitschicken. Nur-Lesen-Tokens können nur lesen (keine Prompts, keine Änderungen).",
+  "tokens.copyNow": "Token jetzt kopieren – er wird nur einmal angezeigt:",
+  "tokens.copy": "Kopieren",
+  "tokens.copied": "Kopiert",
+  "tokens.name": "Name",
+  "tokens.scope": "Rechte",
+  "tokens.lastUsed": "Zuletzt benutzt",
+  "tokens.expires": "Läuft ab",
+  "tokens.never": "nie",
+  "tokens.revoke": "Widerrufen",
+  "tokens.revokeConfirm": "Token „{name}“ widerrufen? Programme, die ihn nutzen, verlieren sofort den Zugriff.",
+  "tokens.namePlaceholder": "Name, z. B. Laptop-CLI",
+  "tokens.scopeFull": "Voller Zugriff",
+  "tokens.scopeRead": "Nur lesen",
+  "tokens.noExpiry": "Kein Ablauf",
+  "tokens.days": "Tage",
+  "tokens.create": "Token erstellen",
   "new.title": "Neue Session",
   "new.directory": "Projektverzeichnis",
   "new.up": "Hoch",

web/src/i18n/en.ts

@@ -369,6 +369,24 @@ export const en = {
   "voice.stop": "Stop dictation",
   "voice.denied": "Microphone access was denied – allow it in the browser settings.",
   "voice.error": "Speech recognition failed",
+  "tokens.title": "API tokens",
+  "tokens.hint": "For the command line client (codecraft) and scripts: send as “Authorization: Bearer <token>”. Read-only tokens can only read (no prompts, no changes).",
+  "tokens.copyNow": "Copy the token now – it is shown only once:",
+  "tokens.copy": "Copy",
+  "tokens.copied": "Copied",
+  "tokens.name": "Name",
+  "tokens.scope": "Rights",
+  "tokens.lastUsed": "Last used",
+  "tokens.expires": "Expires",
+  "tokens.never": "never",
+  "tokens.revoke": "Revoke",
+  "tokens.revokeConfirm": "Revoke the token “{name}”? Programs using it lose access immediately.",
+  "tokens.namePlaceholder": "Name, e.g. laptop CLI",
+  "tokens.scopeFull": "Full access",
+  "tokens.scopeRead": "Read only",
+  "tokens.noExpiry": "No expiry",
+  "tokens.days": "days",
+  "tokens.create": "Create token",
   "new.title": "New session",
   "new.directory": "Project directory",
   "new.up": "Up",

web/src/i18n/index.ts

@@ -25,6 +25,11 @@ let current = detect();
 document.documentElement.lang = current;
 const listeners = new Set<() => void>();
 
+export function onLangChange(fn: () => void) {
+  listeners.add(fn);
+  return () => void listeners.delete(fn);
+}
+
 export function getLang() {
   return current;
 }