Issue machine tokens with limited permissions and an expiry

A token acts as the person who made it, within the permissions it was given
and those they still hold, checked on every request. Permission checks now go
through one gate rule, since spatie's answered first and never asked the
token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lang/ca/rules.php

@@ -44,6 +44,11 @@ return [
         'too_many' => 'Com a molt :max files per importació.',
     ],
 
+    'tokens' => [
+        'ability' => '«:ability» no és un permís que tinguis, així que un token teu no el pot tenir.',
+        'machine' => 'Els tokens els gestiona una persona, no un altre token.',
+    ],
+
     'settings' => [
         'read_only' => 'Aquest ajust l\'escriu l\'aplicació i no es pot editar a mà.',
     ],

lang/en/rules.php

@@ -44,6 +44,11 @@ return [
         'too_many' => 'At most :max rows per import.',
     ],
 
+    'tokens' => [
+        'ability' => '":ability" is not a permission you hold, so a token of yours cannot hold it.',
+        'machine' => 'Tokens are managed by a person, not by another token.',
+    ],
+
     'settings' => [
         'read_only' => 'This setting is written by the application and cannot be edited by hand.',
     ],

lang/es/rules.php

@@ -44,6 +44,11 @@ return [
         'too_many' => 'Como mucho :max filas por importación.',
     ],
 
+    'tokens' => [
+        'ability' => '«:ability» no es un permiso que tengas, así que un token tuyo no puede tenerlo.',
+        'machine' => 'Los tokens los gestiona una persona, no otro token.',
+    ],
+
     'settings' => [
         'read_only' => 'Este ajuste lo escribe la aplicación y no se puede editar a mano.',
     ],