Add API tokens, CLI server API and shared core crate

- Personal API tokens (full/read scope, expiry, revoke) and CLI password login
- Cargo workspace: codecraft-core (types, providers, permission rules) shared by
  server and the upcoming terminal client; server re-exports the old paths
- CLI server API: /cli/config, /cli/skill, /cli/tool (server MCP tools),
  /llm/stream model gateway with budgets and usage per user
- Theme/language preferences mirrored to the server; personal memory endpoint
- Statistics: provider and mode tables stacked; CLI usage labelled
- cli/: work in progress (terminal client is being rewritten as a local TUI)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/i18n/en.ts

@@ -369,6 +369,24 @@ export const en = {
   "voice.stop": "Stop dictation",
   "voice.denied": "Microphone access was denied – allow it in the browser settings.",
   "voice.error": "Speech recognition failed",
+  "tokens.title": "API tokens",
+  "tokens.hint": "For the command line client (codecraft) and scripts: send as “Authorization: Bearer <token>”. Read-only tokens can only read (no prompts, no changes).",
+  "tokens.copyNow": "Copy the token now – it is shown only once:",
+  "tokens.copy": "Copy",
+  "tokens.copied": "Copied",
+  "tokens.name": "Name",
+  "tokens.scope": "Rights",
+  "tokens.lastUsed": "Last used",
+  "tokens.expires": "Expires",
+  "tokens.never": "never",
+  "tokens.revoke": "Revoke",
+  "tokens.revokeConfirm": "Revoke the token “{name}”? Programs using it lose access immediately.",
+  "tokens.namePlaceholder": "Name, e.g. laptop CLI",
+  "tokens.scopeFull": "Full access",
+  "tokens.scopeRead": "Read only",
+  "tokens.noExpiry": "No expiry",
+  "tokens.days": "days",
+  "tokens.create": "Create token",
   "new.title": "New session",
   "new.directory": "Project directory",
   "new.up": "Up",