v0.4.0: Self-service access tokens

Added

• Self-service access token: the chat token command (also create / new / mint / get token)
  mints a read-only, never-expiring claim token scoped to your own account, behind a yes/no confirm
  with a warning. It is the credential a Home Assistant dashboard needs to read your Fanad data, so
  any authorized user can now get one without the owner-only web panel. Shown once.
• Web Settings, Security: an "Expires" dropdown (30 / 90 / 365 days / Never) when minting a token,
  exposing the never-expiring option the backend already supported.