feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

users.api_token held each user's apiKey in plaintext and was looked up by
equality, so a leaked row or backup handed out working keys. Migration
0063 replaces it with api_token_hash (sha256, hex), computed in place
from the existing keys so every Subsonic client keeps working.

The key can no longer be read back: GET /api/me/api-token is gone, and
POST returns the new key once. Settings shows it right after Regenerate
with a copy button and a "won't be shown again" note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/dbq/models.go

@@ -731,7 +731,6 @@ type User struct {
 	ID                  pgtype.UUID
 	Username            string
 	PasswordHash        string
-	ApiToken            string
 	IsAdmin             bool
 	CreatedAt           pgtype.Timestamptz
 	SubsonicPassword    *string
@@ -743,6 +742,7 @@ type User struct {
 	Timezone            string
 	TimezoneUpdatedAt   pgtype.Timestamptz
 	DebugModeEnabled    bool
+	ApiTokenHash        string
 }
 
 type UserInvite struct {