capture: a token writes down from outside the browser

POST /api/capture takes a line of text and puts it on a card in an inbox,
or at the end of today's diary entry, starting the entry when there is none
yet. It answers a logged-in browser, and also a request that carries an
Authorization: Bearer token from :token add, so a phone shortcut, a script
or curl can capture with no tab open.

A token is nwc_ and 32 random bytes. It is shown once, copied, and stored
only as its SHA-256, the way a share key is. Only the capture route reads
the header. The Session extractor never does, so a token opens nothing
else. Wrong tokens go through the login's backoff on a throttle of their
own. A removed token is refused from the next request on, because each
capture looks the hash up again.

A card lands where :card puts one outside the board: the inbox of the space
named by "space", or else of the first space with a board. That rule now
lives server-side as boards::inbox_of. The first line of the text becomes
the title and the rest becomes the notes. Diary text becomes "- HH:MM text"
in WORKSPACE_TIMEZONE, appended to the first document written today at the
top of the diary. That is the entry :today opens. The append keeps a
revision and indexes links like any other save.

:token lists, adds and removes tokens, and completes their names after rm.
The message that shows a new token stays in the status bar instead of
fading, because it cannot be shown again.

web/src/lib/api.ts

@@ -91,6 +91,21 @@ export interface SshKey {
   vault: boolean
 }
 
+/** A token that may capture from outside the browser; the token itself is shown once. */
+export interface ApiToken {
+  id: number
+  name: string
+  created_at: number
+  last_used_at: number | null
+}
+
+/** Where `POST /api/capture` put the text. */
+export interface Captured {
+  to: 'card' | 'diary'
+  id: number
+  where: string
+}
+
 /** What a document said before a save replaced it. */
 export interface RevisionSummary {
   id: number
@@ -582,4 +597,11 @@ export const api = {
 
   setSshKeyVault: (id: number, vault: boolean) =>
     request<{ ok: true }>(`/ssh-keys/${id}`, { method: 'PATCH', body: body({ vault }) }),
+
+  listTokens: () => request<ApiToken[]>('/tokens'),
+
+  addToken: (name: string) =>
+    request<ApiToken & { token: string }>('/tokens', { method: 'POST', body: body({ name }) }),
+
+  removeToken: (id: number) => request<{ ok: true }>(`/tokens/${id}`, { method: 'DELETE' }),
 }