Implement RFID tag dump PWA with REST API, auth, and CI

Add Next.js app with SQLite/Drizzle storage for sites and LF/HF tag
dumps, multi-user Auth.js (credentials + optional OIDC), personal API
tokens in Settings, versioned /api/v1 for UI and future CLI use,
MCT/Proxmark/JSON import-export, PWA offline shell, Vitest tests, and
GitHub Actions CI.

src/lib/auth/tokens.ts

@@ -0,0 +1,25 @@
+import { createHash, randomBytes } from "node:crypto";
+
+const TOKEN_PREFIX = "rfid_";
+
+export function generateApiToken(): {
+  token: string;
+  tokenHash: string;
+  prefix: string;
+} {
+  const secret = randomBytes(32).toString("base64url");
+  const token = `${TOKEN_PREFIX}${secret}`;
+  return {
+    token,
+    tokenHash: hashToken(token),
+    prefix: token.slice(0, 12),
+  };
+}
+
+export function hashToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function isApiTokenFormat(token: string): boolean {
+  return token.startsWith(TOKEN_PREFIX) && token.length > TOKEN_PREFIX.length + 16;
+}