feat: dynamic App API tokens

[jennifer-richards]

Adds Django model-backed API tokens alongside the existing settings-backed ones. Uses Django admin for management.

This works, but is draft for discussion. Also, must update the database snapshot process to clear out this table when producing dev database snapshots.

Still needs a Resource class (which should refuse to serve the models at all)
Disabled the api app from the v1 API. This causes a request for /api/v1/api/ to 404 instead of returning {} as it does at present.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.72%. Comparing base (88cb3bf) to head (548cdd5).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
ietf/api/models.py	67.85%	9 Missing ⚠️
ietf/api/ietf_utils.py	55.55%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #11670      +/-   ##
==========================================
- Coverage   88.73%   88.72%   -0.01%     
==========================================
  Files         337      338       +1     
  Lines       45313    45376      +63     
==========================================
+ Hits        40209    40261      +52     
- Misses       5104     5115      +11     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kesara]

Do we want to keep hashed token here? Similar to PersonalApiKey¹?

Footnotes

1. https://github.com/ietf-tools/datatracker/blob/main/ietf/person/models.py#L523-L533 ↩

[jennifer-richards]

Hashing it is a good idea in principle. Need to think about the tradeoffs here (the concern about operators seeing the value is not as significant as it is with user-owned secrets)

[jennifer-richards]

I think you're right, hashing is the right thing to do.

I updated to store the hash instead. That requires a more sophisticated admin interface to support, so I added that, too.