Add API token management to the admin dashboard

[sdunster]

Summary

• Adds a new API Tokens section (super-admin only) to the admin dashboard: list, create, edit, and revoke.
• The backend already had full support for this (createApiToken / updateApiToken / revokeApiToken mutations, apiTokens / apiToken queries, ApiToken GraphQL type) — this PR is frontend-only, wiring the existing API up to a UI that follows the same patterns as the existing Users/Categories admin pages.
• A newly created token's secret is displayed once, right after creation, with a copy-to-clipboard control (CopyableSecret) — the server never returns it again, so the create flow makes that explicit and links back to the list once copied.
• The list page shows name, granted locations, read-only flag, created/expires/last-used times, and Edit/Revoke actions; revoking asks for confirmation since it's irreversible and immediately breaks anything using the token.
• The edit page reuses the same form (name, read-only, expiry, location grants) and also offers Revoke.
• New nav entry ("API Tokens") and submenu added under the existing super-only menu items (Locations, Users, Categories).

Test plan

• cd web && npm run relay — regenerated Relay artifacts for the new queries/mutations/fragment
• cd web && npx tsc -b — type-checks clean
• cd web && npx eslint <changed files> — no lint errors
• cd web && npx prettier --check <changed files> — formatted
• cd web && npm run test:unit — all 146 existing tests pass
• cd web && npm run build — production build succeeds
• Manually exercised the full flow against make local-e2e (DynamoDB Local) with Playwright, logged in as the seeded super user: created a token and confirmed the secret is shown once with a working copy button, confirmed it appears correctly in the list (name/location/read-only/created), edited it, revoked it, and confirmed it disappears from the (active-only) list afterward.

🤖 Generated with Claude Code

https://claude.ai/code/session_017Ej1v1vpzXp7wMaKpBJELc

---

Generated by Claude Code