feat: allow client-based web tokens

prisma/migrations/20250407090729_add_client_token_mode/migration.sql

@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "APITokenMode" ADD VALUE 'Client';

prisma/migrations/20250407091012_add_client_token_field_to_apitoken/migration.sql

@@ -0,0 +1,5 @@
+-- AlterTable
+ALTER TABLE "APIToken" ADD COLUMN     "clientId" TEXT;
+
+-- AddForeignKey
+ALTER TABLE "APIToken" ADD CONSTRAINT "APIToken_clientId_fkey" FOREIGN KEY ("clientId") REFERENCES "Client"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/schema/auth.prisma

@@ -27,6 +27,7 @@ model Invitation {
 enum APITokenMode {
     User
     System
+    Client
 }
 
 model APIToken {
@@ -38,6 +39,9 @@ model APIToken {
     userId String?
     user   User?   @relation(fields: [userId], references: [id])
 
+    clientId String?
+    client   Client? @relation(fields: [clientId], references: [id], onDelete: Cascade)
+
     acls String[]
 
     @@index([token])

prisma/schema/client.prisma

@@ -1,7 +1,7 @@
 enum ClientCapabilities {
     PeerAPI    @map("peerAPI") // other clients can use the HTTP API to P2P with this client
     UserStatus @map("userStatus") // this client can report this user's status (playing, online, etc etc)
-    CloudSaves       @map("cloudSaves") // ability to save to save slots
+    CloudSaves @map("cloudSaves") // ability to save to save slots
 }
 
 // References a device
@@ -19,6 +19,7 @@ model Client {
     peerAPI ClientPeerAPIConfiguration?
 
     lastAccessedSaves SaveSlot[]
+    tokens            APIToken[]
 }
 
 model ClientPeerAPIConfiguration {