feat(16.3-01): account token API with OpenAPI and phrase keys

- Add list/create/revoke/scopes handlers, validation, and soft revoke
- Regenerate admin OpenAPI and TS types; inventory and conformance cases
- Add server-side api_tokens phrase keys (en/pl)

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/cabana/http.go

@@ -266,6 +266,10 @@ func (s *service) mount(r pact.Router) {
 		g.Put("/account", interactiveOnly(requireAjax(s.accountUpdate)))
 		g.Post("/account/avatar", interactiveOnly(requireAjax(s.avatarUpload)))
 		g.Delete("/account/avatar", interactiveOnly(requireAjax(s.avatarRemove)))
+		g.Get("/account/tokens", interactiveOnly(s.accountTokensList))
+		g.Post("/account/tokens", interactiveOnly(requireAjax(s.accountTokenCreate)))
+		g.Get("/account/tokens/scopes", interactiveOnly(s.accountTokenScopes))
+		g.Delete("/account/tokens/{id}", interactiveOnly(requireAjax(s.accountTokenRevoke)))
 		g.Get("/navigation", s.navigation)
 		// Plugin field types (pact.HasFormFieldTypes): the SPA loads their
 		// scripts and styles once after sign-in.