console: sync the registration wizard and issue real API tokens

Mirror the Console registration feature: native hook catalog with
activation plans, one-command install that embeds both credentials in
exclusively created owner-only files (mktemp on POSIX, icacls on
Windows), sh/PowerShell tabs, never-expiring default token, focus-visible
styles, merged i18n keys, and the matching e2e specs.

The server previously answered /v1/auth/token with the 7-day Better Auth
session token and ignored ttl_seconds. It now issues opaque 32-byte API
tokens stored as SHA-256 hashes (migration 003), honours ttl_seconds with
null meaning no expiry, and resolves bearer values as API tokens before
session validation. Issuance requires a session credential.

Claude-Session: https://claude.ai/code/session_01QoUjdc7HGKTsgj5GhG8HvF

README.md

@@ -259,13 +259,13 @@ Return the current session and user profile. Requires a valid session token or c
 
 #### `POST /v1/auth/token`
 
-Issue a long-lived API token.
+Issue an opaque API token for SDK and hook use. Requires a Better Auth session; the token is returned once and only its SHA-256 hash is stored.
 
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
-| `ttl_seconds` | integer \| null | no | Token lifetime in seconds. `null` for non-expiring. |
+| `ttl_seconds` | integer \| null | no | Token lifetime in seconds, from 1 to 31536000. `null` or omitted for non-expiring. |
 
-**Response:** `{ "token": "<api-token>", "expires_at": <ms> | null }`
+**Response:** `{ "token": "<api-token>", "expires_at": <unix seconds> | null }`
 
 ---