Slice 12 — Personal Access Tokens for git over HTTPS

[safayavatsal]

What to build

PATs for environments where SSH is awkward (corporate networks, CI runners, etc.).

• Web UI: profile section to mint a PAT (with a name and optional expiry), copy the token once at creation, list existing PATs (showing only metadata, never the secret), and revoke.
• platform-api: PATs are stored hashed (never plaintext). On Git HTTPS auth, the username is the user's handle and the password is the PAT. PATs identify the user; permissions are still resolved via PermissionChecker.
• Tokens carry an optional scope at this stage (git:read, git:write); finer-grained scopes are post-MVP.

Acceptance criteria

• A user can mint a PAT, see it once, and use it as the password in git clone https://<handle>@forge.../....
• PATs in the database are hashed; plaintext is never recoverable from the DB.
• Revoking a PAT immediately denies subsequent Git operations using it.
• An expired PAT is rejected with a clean error.
• PATs can be listed in the UI with name, last-used timestamp, expiry — but never the secret.

Blocked by

• Slice 4 — User can 'git push'; web file viewer renders the commit #4