Add API token management system

[ba88im]

Summary

• Adds a new ApiToken model with course scoping, user association, expiration, usage tracking (last_used_at), read/write permissions, and secure token storage (SHA-256 digest, never plaintext)
• Adds an instructor-only "API Tokens" management page (view + revoke) accessible from the course sidebar
• Updates the CSV export endpoint to support both the new token system and the legacy readonly_api_token for backward compatibility
• Includes a rake task (rake api_tokens:migrate_legacy_tokens) to migrate existing legacy tokens to the new system, linked to the auto-approval system user

Context

Previously, each course had a single readonly_api_token stored in plaintext on the courses table — no user association, no expiration, no management UI. This PR replaces that with a proper token system that supports multiple tokens per course, each scoped to a user with configurable permissions.

Phase 1 (this PR): model + view/delete UI + migration tooling
Phase 2 (future): token creation UI

Related: #155 (Slack approve/deny links will use read+write tokens)

Test plan

• Run rails db:migrate and verify api_tokens table is created
• Run bundle exec rspec spec/models/api_token_spec.rb — model tests pass
• Run bundle exec rspec spec/controllers/api_tokens_controller_spec.rb — controller tests pass
• Navigate to /courses/:id/api_tokens as instructor — see token table
• Verify students cannot access the API Tokens page
• Revoke a token and verify it shows as revoked
• Verify CSV export still works with legacy readonly_api_token
• Run rake api_tokens:migrate_legacy_tokens and verify tokens are migrated

[cycomachead]

@ba88im Thanks for working on this. Is there a resolution to how read only tokens are handled when we need to get a token for the google sheets integrations?

[ba88im]

Yes, for this PR the Google Sheets flow remains backed by the existing course readonly_api_token. The migration stores a digest of that token in api_tokens, and the export endpoint accepts the existing readonly_api_token query param but validates it through the new APIToken lookup. The instructor Requests page still reads @course.readonly_api_token to generate the Google Sheets IMPORTDATA URL, so existing/current Sheets setup keeps working.

The digest-only issue is still relevant for future newly-created tokens: once we add token creation UI, the raw token/Sheets URL will need to be shown once at creation time, since it cannot be reconstructed from token_digest. So I think this PR handles the migration/backward-compatible flow, and Phase 2 should handle one-time display/copy for new read-only Sheets tokens.