Issue #3615495: Support the Key module for API token storage

Sergey Drakrequested to merge
issue/myrest-3615495:3615495-security-support-the into 1.0.x

The slug already resolved through a key entity; the login/token pairs did not. Adds a tokens_key_id setting and a Tokens key select, with the pairs carried as a JSON list. getSlugFromKey() becomes getValueFromKey() and serves both.

A key value that does not parse is treated as no key rather than as an empty token set, so a typo cannot lock every client out while state still holds working credentials. With a key selected the textarea is disabled and the submit handler skips setUserTokens(), so saving the form cannot copy the key's secrets into state.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Closes #3615495

Merge request reports