Access tokens API

Caller must have grant ALL and scope ALL_REPO.

POST /v1/access-tokens

{
  "name": "ci",
  "scope": "ALL_REPO",
  "grants": ["GIT_HTTP_READ", "GIT_HTTP_WRITE"],
  "repository_ids": [],
  "expires_at": null
}

SELECTED_REPO requires repository_ids. ALL_REPO requires that list empty.

201 includes token (the secret). GET/list omit it.

GET /v1/access-tokens

{ "access_tokens": [ ... ] }

GET /v1/access-tokens/{id}

PUT /v1/access-tokens/{id}

Partial update. Same validation as create for scope vs repository ids.

DELETE /v1/access-tokens/{id}