v0.30.0 — token privilege fixes

Picks up laravel-id v0.63.0: /user-tokens/introspect required no scope (any environment API key could introspect every PAT in its environment), and an empty resource-family allow-list granted every family.

Both are breaking upstream and both have zero blast radius here — verified against the production database, which holds 0 environment API keys and 0 user API tokens, and this app calls neither changed contract.

Also carries a table rename (password_reset_tokens → cbox_id_password_reset_tokens, which collided with Laravel's own skeleton migration). Requires php artisan migrate — on PostgreSQL a rename, not a rewrite.