Add API token management for CLI authentication

- Add reviq auth login --token <token> command for CLI authentication
- Create /account/api-tokens page for token management (superuser only)
- Add me.apiTokens endpoints (list, create, delete)
- Require superuser status and trusted session for token creation
- Show API Tokens nav link only for superusers

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

packages/api-contract/src/contract.ts

@@ -13,6 +13,9 @@ import {
   adminUpdateUserInputSchema,
 } from "./schemas/admin.js";
 import {
+  apiTokenOutputSchema,
+  createApiTokenInputSchema,
+  createApiTokenOutputSchema,
   forgotPasswordInputSchema,
   loginPasswordInputSchema,
   loginRequestInputSchema,
@@ -160,6 +163,17 @@ export const contract = oc.router({
       .input(z.object({ deviceId: z.number() }))
       .output(successResponseSchema),
     revokeAllTrustedDevices: oc.output(successResponseSchema),
+
+    // API tokens for CLI/programmatic access
+    apiTokens: oc.router({
+      list: oc.output(z.array(apiTokenOutputSchema)),
+      create: oc
+        .input(createApiTokenInputSchema)
+        .output(createApiTokenOutputSchema),
+      delete: oc
+        .input(z.object({ tokenId: z.number() }))
+        .output(successResponseSchema),
+    }),
   }),
 
   orgs: oc.router({