Issue machine tokens with limited permissions and an expiry

A token acts as the person who made it, within the permissions it was given
and those they still hold, checked on every request. Permission checks now go
through one gate rule, since spatie's answered first and never asked the
token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Models/User.php

@@ -42,6 +42,32 @@ class User extends Authenticatable implements FilamentUser, HasAvatar, HasName
      */
     protected string $guard_name = 'web';
 
+    /**
+     * The machine token this request came in with, when it did. Not stored:
+     * it describes the request, not the person.
+     */
+    protected ?ApiToken $accessToken = null;
+
+    public function withAccessToken(?ApiToken $token): static
+    {
+        $this->accessToken = $token;
+
+        return $this;
+    }
+
+    public function currentAccessToken(): ?ApiToken
+    {
+        return $this->accessToken;
+    }
+
+    /**
+     * @return HasMany<ApiToken, $this>
+     */
+    public function apiTokens(): HasMany
+    {
+        return $this->hasMany(ApiToken::class);
+    }
+
     /**
      * Get the attributes that should be cast.
      *