API tokens

Long-lived bearer tokens for scripts and other services. A token is shown once, when you create it; only its SHA-256 digest is stored, so a lost token can't be recovered: revoke it and make a new one. Changing your password revokes all of them.