Add API tokens and OAuth2 client support for external integrations

- Personal API tokens (model, user-settings UI, admin, management command,
  DRF auth class) for non-interactive API access from automations like n8n.
  Raw token shown once; only a SHA-256 hash is stored; last_used_at writes
  are throttled.
- OAuth2 authorization server via django-oauth-toolkit with authorization
  server metadata and optional, off-by-default Dynamic Client Registration
  (RFC 7591), so remote OAuth/MCP clients can authenticate and self-register.
- Tests for token auth, DCR gating and the management commands, plus
  .env.example and README documentation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker/dev/django/start

@@ -15,5 +15,6 @@ python manage.py migrate
 touch /tmp/migrations_complete
 
 python manage.py setup_users
+python manage.py setup_oauth
 
 exec python manage.py runserver 0.0.0.0:$INTERNAL_PORT

docker/prod/django/start

@@ -16,5 +16,6 @@ python manage.py migrate
 touch /tmp/migrations_complete
 
 python manage.py setup_users
+python manage.py setup_oauth
 
 exec gunicorn WYGIWYH.wsgi:application --bind 0.0.0.0:$INTERNAL_PORT --timeout 600