Add automatic short-lived API token refresh (GL-1709)

[timmarkhuff]

Summary

• Treats GROUNDLIGHT_API_TOKEN as a bootstrap credential: the client mints a short-lived working token, caches it on disk, and refreshes it daily in a background thread.
• Syncs the public OpenAPI spec (api-tokens list/create/delete + by-snippet) and regenerates the client so token management goes through the generated API.
• Coordinates multi-process refresh with a sibling file lock and atomic writes; remints via the bootstrap token if a cached working token gets a 401.

Design notes

• Token TTL is 30 days; refresh interval is 1 day; previous tokens are deleted after a 2x grace window.
• Cache slots live under the platform user data dir (override with GROUNDLIGHT_TOKEN_DIR), keyed by the bootstrap token snippet.
• Name lookup currently pages through GET /v1/api-tokens and matches raw_key_snippet. _get_token_name_by_snippet is implemented but unused until zuuul#6579 is live; TODOs mark the switch-before-merge.

Test plan

• poetry run pytest test/unit/test_token_manager.py -v --noconftest
• Start Groundlight() against integ/prod; confirm a slot file is written and whoami succeeds with the minted token
• Second process sharing the same token dir does not double-mint while the first holds the lock
• Before merge: switch _lookup_token_name to _get_token_name_by_snippet once zuuul#6579 is deployed