feat(auth): support API tokens and bearer token authentication

- Add backend services to create, list, and delete API tokens.
- Implement Bearer token authentication to resolve tokens to users.
- Register HTTP routes for managing user tokens under `/account/tokens`.
- Add tests to verify that uploads with valid Bearer tokens associate the upload with the correct user, while invalid tokens fall back to anonymous uploads.

backend/libs/handlers/app.go

@@ -56,6 +56,8 @@ func (a *App) RegisterRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("POST /app/boxes/{boxID}/delete", a.DeleteUserBox)
 	mux.HandleFunc("GET /account/settings", a.AccountSettings)
 	mux.HandleFunc("POST /account/password", a.ChangePassword)
+	mux.HandleFunc("POST /account/tokens", a.CreateUserToken)
+	mux.HandleFunc("POST /account/tokens/{tokenID}/delete", a.DeleteUserToken)
 	mux.HandleFunc("GET /admin/login", a.AdminLogin)
 	mux.HandleFunc("POST /admin/login", a.AdminLoginPost)
 	mux.HandleFunc("POST /admin/logout", a.AdminLogout)