feat(accounts): API tokens show their last use, and a user has at most ten

The API Tokens tab gets a "Last used" column, so an unused token can be
told from one a script still needs. The token's last use is written when
it authenticates, at most once a minute (accounts.auth.TokenAuthentication,
knox's class with that one addition; the API schema describes it as
knox's).

A user has at most ten tokens; a new one is refused until one is
deleted. Expired tokens do not count, and are deleted when a new token is
made.

webvirtcloud/settings.py.template

@@ -368,7 +368,7 @@ REST_FRAMEWORK = {
     # tokens are made in a session. The token class comes first, so a refused
     # request gets 401 with its challenge, not 403.
     "DEFAULT_AUTHENTICATION_CLASSES": [
-        "knox.auth.TokenAuthentication",
+        "accounts.auth.TokenAuthentication",
         "rest_framework.authentication.SessionAuthentication",
     ],
     # A view that forgets its own permission_classes is not public.

webvirtcloud/tests/test_otp_bypass.py

@@ -17,7 +17,7 @@ class BasicAuthDisabledTestCase(TestCase):
         # A token is no other door: it is made in a session that passed the
         # login and its OTP (accounts.views.api_token_create)
         classes = [f"{c.__module__}.{c.__name__}" for c in api_settings.DEFAULT_AUTHENTICATION_CLASSES]
-        self.assertEqual(classes, ["knox.auth.TokenAuthentication",
+        self.assertEqual(classes, ["accounts.auth.TokenAuthentication",
                                    "rest_framework.authentication.SessionAuthentication"])
 
     def test_api_rejects_http_basic_credentials(self):