Add token auth scheme

# Feature ## Thesis DMR ships JWT auth but has no long-lived user-bound opaque token that authenticates without the access/refresh cycle. I'd like to propose adding one at `dmr.security.token`, alongside the existing JWT scheme. Rough sketch of issuance: ```python from dmr.security.token.models import Token token, raw = Token.objects.create_token(user=request.user, name="CI pipeline") # `raw` is shown once at creation ``` ```http GET /api/resource/ HTTP/1.1 Authorization: Token <raw_token> ``` Properties: - Opaque (random string, no payload) - Optional expiry that (maybe?) never-expires by default, configurable per token - Named tokens (`"CI pipeline"`, `"Mobile app v2"`) so they're auditable and individually revocable - Per-token revocation that doesn't touch the user's other tokens (an improvement over DRF's one-token-per-user default) - Stored hashed, so the raw value is only ever returned at creation time ## Reasoning JWTs are great for stateless, short-lived sessions, but they're an awkward fit for long-lived machine-to-machine credentials. For example, a CI job or embedded device doesn't want to implement refresh logic, and there's no clean per-credential revocation. Worth calling out that I recognize this would introduce a DB lookup mechanism to the project, which brings it's own ... stuff. If there's interest, I'm happy to implement it as I'm building exactly this in my own project, so I'd be porting work I'm doing anyway.