feat: add DB-backed token management to SQLiteAdapter

[cuibonobo]

Summary

• Adds a tokens table to the SQLite schema with (id, token_hash, entity_id, label, created_at, expires_at) columns and idx_tokens_hash index for fast lookup
• Exports TokenInfo type from @haverstack/adapter-sqlite
• Adds four new methods to SQLiteAdapter:
  • createToken(entityId, opts?) — generates a random token, stores SHA-256 hash, returns { id, token } (plaintext exposed only once)
  • lookupToken(token) — hashes and looks up; returns { entityId } or null (respects expires_at)
  • listTokens() — returns all TokenInfo objects without plaintext values
  • revokeToken(id) — deletes by token ID

Motivation

The server's OWNER_TOKEN env var is the single bootstrap credential. All other tokens are issued and revoked at runtime via the /tokens API — no server restarts required. Storing hashes (SHA-256) means a DB breach doesn't expose usable tokens.

Test plan

• createToken returns a 16-char hex id and 64-char hex plaintext token
• lookupToken returns entityId for a valid token
• lookupToken returns null for an unknown token
• lookupToken returns null for an expired token
• lookupToken returns entityId for a non-expired token
• listTokens returns all tokens without plaintext values
• revokeToken removes the token so lookupToken returns null
• label and expiresAt round-trip through listTokens

---

Generated by Claude Code