AlphOne 0.13.0

Every API token is now scoped and mortal. A token carries a set of scopes checked on each operation and an expiry that ends it, and its owner mints, lists and revokes tokens from the app rather than a shell. Existing tokens keep full scope
and no expiry until they are replaced.

A second plugin root named enterprise ships empty under its own license, so a closed plugin can join a build without editing public files.

• API tokens carry scopes, so a connector reaches only the areas it was granted
• API tokens expire, ninety days by default from the command line
• A Tokens screen mints, lists and revokes them, showing each secret once
• Token management needs a login session, so a leaked token cannot mint another
• A second plugin root reads closed plugins without editing public files
• The route outline composes from plugin exports rather than a hardcoded map

Upgrading needs no action. The migration grants every existing token full scope and no expiry, and refusals name the scope they needed, so a token minted before this release keeps working exactly as it did.