feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

users.api_token held each user's apiKey in plaintext and was looked up by
equality, so a leaked row or backup handed out working keys. Migration
0063 replaces it with api_token_hash (sha256, hex), computed in place
from the existing keys so every Subsonic client keeps working.

The key can no longer be read back: GET /api/me/api-token is gone, and
POST returns the new key once. Settings shows it right after Regenerate
with a copy button and a "won't be shown again" note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/lib/api/me.ts

@@ -46,10 +46,11 @@ export async function updateProfile(input: { display_name?: string; email?: stri
   return api.put<MyProfile>('/api/me/profile', input);
 }
 
-export async function getAPIToken(): Promise<APITokenResponse> {
-  return api.get<APITokenResponse>('/api/me/api-token');
-}
-
+/**
+ * Mints a new API key and returns it. The server keeps only its hash, so
+ * this is the one time the key can be read; there is no way to fetch it
+ * again later.
+ */
 export async function regenerateAPIToken(): Promise<APITokenResponse> {
   return api.post<APITokenResponse>('/api/me/api-token', {});
 }