feat: add delete button for revoked API tokens

Revoked tokens previously stayed in the list with no way to remove them.
Adds a delete action (hard delete, scoped to the owner, gated behind
demo mode) shown on revoked rows, alongside the existing revoke action on
active ones.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/apps/users/views.py

@@ -168,6 +168,17 @@ def api_token_revoke(request, token_id):
     return _render_api_tokens(request)
 
 
+@only_htmx
+@htmx_login_required
+@disabled_on_demo
+@require_http_methods(["DELETE"])
+def api_token_delete(request, token_id):
+    token = get_object_or_404(APIToken, id=token_id, user=request.user)
+    token.delete()
+    messages.success(request, _("API token deleted successfully"))
+    return _render_api_tokens(request)
+
+
 @only_htmx
 @htmx_login_required
 @require_http_methods(["GET"])