Issue machine tokens with limited permissions and an expiry

A token acts as the person who made it, within the permissions it was given
and those they still hold, checked on every request. Permission checks now go
through one gate rule, since spatie's answered first and never asked the
token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mcp/server.mjs

@@ -20,7 +20,8 @@
  *
  *   LANDING_USERNAME         Pireon credentials for the admin API (/v1). The
  *   LANDING_PASSWORD           token is obtained and refreshed automatically.
- *   LANDING_TOKEN            Or a fixed bearer token instead.
+ *   LANDING_TOKEN            Or a fixed bearer token instead — a machine token
+ *                            (pmt_…) with only the permissions needed.
  *
  * HTTP only — every request brings its own credentials (see src/http.mjs):
  *