feat(accounts): API tokens show their last use, and a user has at most ten

The API Tokens tab gets a "Last used" column, so an unused token can be
told from one a script still needs. The token's last use is written when
it authenticates, at most once a minute (accounts.auth.TokenAuthentication,
knox's class with that one addition; the API schema describes it as
knox's).

A user has at most ten tokens; a new one is refused until one is
deleted. Expired tokens do not count, and are deleted when a new token is
made.

accounts/models.py

@@ -87,7 +87,10 @@ class PermissionSet(models.Model):
 class ApiToken(AbstractAuthToken):
     """A token for the REST API, kept as a digest (django-rest-knox); the
     name says what uses it."""
+    LIMIT = 10  # per user, expired ones not counted
+
     name = models.CharField(_("name"), max_length=64)
+    last_used = models.DateTimeField(_("last used"), null=True, blank=True)
 
     class Meta:
         ordering = ["-created"]