feat(tokens): T41-T43 implement API token management endpoints

- Add max_api_tokens_per_user config (default 5)
- Implement POST /api/tokens (T41): generate token with limit check
- Implement GET /api/tokens (T42): list active tokens, no values exposed
- Implement DELETE /api/tokens/{id} (T43): soft delete with ownership check
- Security: plaintext token shown ONLY at creation
- Security: SHA-256 hash stored in DB, never the plaintext
- Security: revoked tokens return 401 on public API
- 24 tests with 100% coverage on tokens router

Closes T41, T42, T43

src/openrouter_monitor/config.py

@@ -62,6 +62,10 @@ class Settings(BaseSettings):
         default=10,
         description="Maximum API keys per user"
     )
+    max_api_tokens_per_user: int = Field(
+        default=5,
+        description="Maximum API tokens per user"
+    )
     rate_limit_requests: int = Field(
         default=100,
         description="API rate limit requests"