Implement RFID tag dump PWA with REST API, auth, and CI

Add Next.js app with SQLite/Drizzle storage for sites and LF/HF tag
dumps, multi-user Auth.js (credentials + optional OIDC), personal API
tokens in Settings, versioned /api/v1 for UI and future CLI use,
MCT/Proxmark/JSON import-export, PWA offline shell, Vitest tests, and
GitHub Actions CI.

src/app/api/v1/tokens/[id]/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest } from "next/server";
+import { and, eq } from "drizzle-orm";
+import { requireApiUser, jsonError, jsonOk } from "@/lib/api/auth-guard";
+import { getDb } from "@/db/client";
+import { apiTokens } from "@/db/schema";
+
+type Ctx = { params: Promise<{ id: string }> };
+
+export async function DELETE(request: NextRequest, context: Ctx) {
+  const userOrRes = await requireApiUser(request);
+  if (userOrRes instanceof Response) return userOrRes;
+
+  const { id } = await context.params;
+  const db = getDb();
+  const existing = db
+    .select()
+    .from(apiTokens)
+    .where(and(eq(apiTokens.id, id), eq(apiTokens.userId, userOrRes.id)))
+    .get();
+
+  if (!existing) {
+    return jsonError(404, "NOT_FOUND", "Token not found");
+  }
+
+  db.delete(apiTokens).where(eq(apiTokens.id, id)).run();
+  return jsonOk({ ok: true });
+}