console: sync the registration wizard and issue real API tokens

Mirror the Console registration feature: native hook catalog with
activation plans, one-command install that embeds both credentials in
exclusively created owner-only files (mktemp on POSIX, icacls on
Windows), sh/PowerShell tabs, never-expiring default token, focus-visible
styles, merged i18n keys, and the matching e2e specs.

The server previously answered /v1/auth/token with the 7-day Better Auth
session token and ignored ttl_seconds. It now issues opaque 32-byte API
tokens stored as SHA-256 hashes (migration 003), honours ttl_seconds with
null meaning no expiry, and resolves bearer values as API tokens before
session validation. Issuance requires a session credential.

Claude-Session: https://claude.ai/code/session_01QoUjdc7HGKTsgj5GhG8HvF

packages/console/src/components/agent-registration/CredentialsStep.tsx

@@ -35,6 +35,7 @@ function CredentialRow({ label, value }: { readonly label: string; readonly valu
     </div>
   );
 }
+
 export default function CredentialsStep({
   credentials,
   token,
@@ -44,7 +45,7 @@ export default function CredentialsStep({
   onContinue,
 }: CredentialsStepProps) {
   const { t } = useTranslation();
-  const [expiration, setExpiration] = useState<ExpirationId>('24hours');
+  const [expiration, setExpiration] = useState<ExpirationId>('neverExpire');
   const [customDays, setCustomDays] = useState('');
   const [validationError, setValidationError] = useState<string | null>(null);