Labeled API tokens for non-local users #36

Background

Currently each user has a single bearer token stored in users.token_hash.
This is sufficient for the single-user / local-access case but too coarse for
multi-user or tool-integration scenarios.

Goal

Personal-access-token model (similar to GitHub tokens): each user can create
multiple named tokens, each independently revocable.

Proposed schema

CREATE TABLE user_tokens (
    id          INTEGER PRIMARY KEY,
    user_id     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    label       TEXT    NOT NULL,           -- e.g. "openclaw-home", "claude-desktop"
    token_hash  TEXT    NOT NULL UNIQUE,
    created_at  TEXT    NOT NULL,
    last_used_at TEXT,
    UNIQUE(user_id, label)
);

CLI verbs

ragger token create <label>   # mint, print once, store hash
ragger token revoke <label>   # delete row
ragger token list             # show label + created_at + last_used_at (no raw token)

HTTP API (for remote users via browser session)

POST   /auth/tokens          { "label": "my-tool" }  → { "token": "<raw>", "label": "..." }
DELETE /auth/tokens/:label
GET    /auth/tokens          → [ { "label", "created_at", "last_used_at" }, ... ]

Auth middleware change

_check_auth should check user_tokens.token_hash in addition to
(or instead of) users.token_hash. Both columns can coexist during
migration; users.token_hash becomes the "legacy single token" path.

Access scope

Initial scope: RAG data only (store / search / recall).
Future: see related issue for sharing other data types.

Non-local access gate

Non-local requests (not 127.0.0.1 / ::1 / unix socket) require either:

• A valid labeled API token in user_tokens
• Or a web session cookie (uname + passwd login via POST /auth/login)

Local requests remain auto-authenticated as the daemon owner (no change).