feat: add token-based API access (v0.6.0)

- Add Token GORM model with UserID/Name/Token/LastUsedAt/ExpiresAt fields
- Add TokenManager controller: List/Create/Delete/Verify operations
- Add token HTTP handlers: list, create, revoke
- Update AuthVerify to support Bearer token auth; API tokens use "ust_" prefix to distinguish from session tokens
- Add one-step file upload endpoint: PUT /api/v1/upload/:filename (returns {"status":200,"data":{"code":"..."}})
- Add token management routes: GET/POST/DELETE /api/token
- Add /self page: personal center with account info, token management table, and curl usage guide
- Add "个人中心 / API Token" nav link for users with token_manage permission

🤖 Generated with [Qoder][https://qoder.com]

main.go

@@ -48,7 +48,7 @@ func main() {
 	}
 	log.Debug("main: db initialized at %s", dbPath)
 
-	if err := db.Default.Migrate(&model.Role{}, &model.User{}); err != nil {
+	if err := db.Default.Migrate(&model.Role{}, &model.User{}, &model.Token{}); err != nil {
 		log.Fatal("main: db migrate failed: %s", err.Error())
 	}