feat(auth): support API tokens and bearer token authentication

- Add backend services to create, list, and delete API tokens.
- Implement Bearer token authentication to resolve tokens to users.
- Register HTTP routes for managing user tokens under `/account/tokens`.
- Add tests to verify that uploads with valid Bearer tokens associate the upload with the correct user, while invalid tokens fall back to anonymous uploads.

backend/static/js/app.js

@@ -244,6 +244,16 @@
     }
   }
 
+  /* Access token: copy one-time secret */
+  const tokenCopyBtn = document.querySelector("[data-token-copy]");
+  if (tokenCopyBtn) {
+    tokenCopyBtn.addEventListener("click", () => {
+      const valueEl = document.querySelector("[data-token-value]");
+      if (!valueEl) return;
+      copyText(valueEl.textContent.trim(), tokenCopyBtn, "Copied");
+    });
+  }
+
   if (!form || !dropZone || !fileInput) {
     return;
   }