feat(accounts): API tokens for scripts and tools

The REST API took only the login session, so a script could not use it
without a browser. A user now makes API tokens on the profile page (API
Tokens tab): a name, and an expiry of 30, 90 or 365 days or none. The
token is shown once, on a page that is not cached, and then kept only as
a SHA-512 digest; the list shows its name, first characters, creation
and expiry, and a token is deleted there. Tools send it as
"Authorization: Token wvc_...", and act as its user, with that user's
permissions. Making and deleting a token is logged, without the token.

A password alone (HTTP Basic) still does not reach the API, as it would
skip the OTP second factor: a token is made in a session that passed the
login and its OTP. The token class comes first, so a refused request gets
401 with its challenge instead of 403.

django-rest-knox 5.1.0 provides the tokens (accounts.ApiToken adds the
name); settings.py takes "knox", KNOX_TOKEN_MODEL and REST_KNOX from the
template.

conf/requirements.txt

@@ -9,6 +9,7 @@ requests>=2.33.0
 urllib3>=2.8.0
 django-axes==8.3.1
 djangorestframework==3.18.3
+django-rest-knox==5.1.0
 drf-nested-routers==0.95.3
 drf-spectacular[sidecar]==0.30.0
 gunicorn==26.2.0