[rbruhn]

Adds an API Tokens page to the Filament admin (Secondary group), so Sanctum tokens no longer have to be made or revoked in tinker. It's needed to test #568 on development and for #551.

The page

• List: name, user (email), abilities, last used, expires and created, newest first; search by name.
• Create: pick the user (searched by email), a name, one or more abilities from checkboxes, and an optional expiry (must be in the future; empty means it never expires). The token is made with $user->createToken(), so it's stored hashed as before.
• Show once: after saving, the list page opens a modal with the plain-text token, a copy button and a "you won't see this again" note. The token is passed through a one-time session flash, so reloading the page doesn't show it again.
• Revoke: a Revoke row action deletes the token after a confirmation.
• Access: admins only, like every other resource: the panel's canAccessPanel() checks isAdmin().

Abilities in one place

The known abilities are now an ApiAbility enum. The page's checkboxes and the route middleware both use it: ApiAbility::middleware() builds the ability: string for the v1 group (all abilities), the WeDigBio dashboard route (its four) and the projects and expeditions routes (public:read). The middleware strings are unchanged (checked with route:list).

Tested locally

• New tests/Feature/Admin/ApiTokenResourceTest.php: non-admins get 403; the list shows tokens with owner and abilities; creating saves the chosen abilities and expiry; the new token is queued for the modal only once; it works as a bearer token on /v1/projects and gets 403 on the WeDigBio dashboard; no ability or an unknown one (*) is rejected; revoking deletes the token.
• tests/Feature/Admin/ApiTokenResourceTest.php and tests/Feature/Api: 24 passed.
• I didn't open the page in a browser locally, so the modal opening on page load and the copy button are in the development checks.

To verify on development

See #567.