Issue machine tokens with limited permissions and an expiry

A token acts as the person who made it, within the permissions it was given
and those they still hold, checked on every request. Permission checks now go
through one gate rule, since spatie's answered first and never asked the
token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

database/migrations/2026_10_01_090000_create_api_tokens_table.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Access tokens for machines: scripts, CI, an integration — anything that
+ * should reach the admin API without a person's password and with less than
+ * that person may do.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('api_tokens', function (Blueprint $table): void {
+            $table->id();
+
+            // Whose permissions it borrows from. Deleting the person takes
+            // their tokens with them.
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('name');
+
+            // Only the hash is kept: the token is shown once, when it is made.
+            $table->string('token_hash', 64)->unique();
+
+            // The first characters, to tell tokens apart in a list.
+            $table->string('prefix', 12);
+
+            $table->jsonb('abilities');
+            $table->timestamp('expires_at');
+            $table->timestamp('last_used_at')->nullable();
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('api_tokens');
+    }
+};