[IMPROVEMENT] Add workspace-scoped service API tokens and management UI

[martian56]

Type / Priority

Improvement / Medium

Summary

API tokens are personal/user-scoped only; there are no workspace-scoped service tokens or a workspace token management page.

Current state (evidence)

• Token backend is user-scoped (/api/users/me/tokens/, store/api_token.go); the UI lives under Account settings. The api_tokens.workspace_id column exists but is never set/used.

Relationship to #162

#162 is about tokens not being accepted by auth at all; this issue is the missing workspace-scoped token management surface (assumes #162 is fixed).

Proposed scope

Add workspace-scoped token endpoints populating workspace_id and a workspace-settings tokens page (reuse the personal-token UI as a base).