feat(auth): self-service git push tokens from the dashboard

GET/POST /api/auth/gitpush-token (+ /revoke) on auth-api: session-scoped, CSRF-gated,
3 mints per account per hour, bcrypt into the htpasswd, plaintext returned once and
never stored, audit at /var/lib/webx11/git-push-audit.jsonl.

No sudo or reload needed: nginx re-opens auth_basic_user_file per request, so a new
line is live immediately — proved by a 500 whose error line was per request.

Dashboard card 'Git push token' shows none/active, mints and reveals the remote once,
revokes. Verified in a real browser: badge none -> mint -> active, remote shape checked,
then revoked; htpasswd back to 0 bytes and the test session removed.

0 files changed, 0 insertions, 0 deletions