Issue machine tokens with limited permissions and an expiry

A token acts as the person who made it, within the permissions it was given
and those they still hold, checked on every request. Permission checks now go
through one gate rule, since spatie's answered first and never asked the
token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Api/AdminApiContractTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Tests\Feature\Api;
 
+use App\Models\ApiToken;
 use App\Models\Application;
 use App\Models\Call;
 use App\Models\Category;
@@ -92,6 +93,7 @@ class AdminApiContractTest extends TestCase
             'missing-urls' => ['path' => '/v1/missing-urls'],
             'repositories' => ['path' => '/v1/repositories'],
             'media' => ['path' => '/v1/media'],
+            'tokens' => ['path' => '/v1/tokens'],
         ];
     }
 
@@ -115,6 +117,7 @@ class AdminApiContractTest extends TestCase
         Setting::set(Maintenance::KEY, ['enabled' => false]);
         $media = Media::factory()->create();
         $page->comment('Primera nota', $this->caller);
+        ApiToken::issue($this->caller, 'CI', ['pages.*'], now()->addDay());
 
         // One request, one documented path — the URL a real caller hits and
         // the path key that describes it, side by side rather than derived
@@ -155,6 +158,7 @@ class AdminApiContractTest extends TestCase
             'media' => ['/v1/media', '/v1/media'],
             'medium' => ["/v1/media/{$media->id}", '/v1/media/{media}'],
             'revisions' => ["/v1/projects/{$project->id}/revisions", '/v1/projects/{project}/revisions'],
+            'tokens' => ['/v1/tokens', '/v1/tokens'],
             'review thread' => ["/v1/pages/{$page->id}/reviews", '/v1/pages/{page}/reviews'],
             'users' => ['/v1/users', '/v1/users'],
             'user' => ["/v1/users/{$this->caller->id}", '/v1/users/{user}'],