aadc46b3d3
* docs(superpowers): add DISABLE_ACCESS_TOKENS design spec * docs(superpowers): add DISABLE_ACCESS_TOKENS implementation plan * feat(api): register DISABLE_ACCESS_TOKENS instance config * feat(api): add are_access_tokens_disabled helper * feat(api): block access token auth/creation when disabled (app) * feat(api): block access token auth when disabled (public api) Guard the public-API-layer APIKeyAuthentication against disabled access tokens, and add contract tests covering user-token rejection and service-token pass-through. * feat(api): expose are_access_tokens_disabled on instance endpoint * feat(types): add DISABLE_ACCESS_TOKENS config key and flag * feat(admin): add Security section with disable access tokens toggle * feat(web): add InstanceTokensDisabledBanner component * feat(web): hide token creation UI and show banner when disabled * feat(api): add DISABLE_AT_INSTANCE_LEVEL error code to access token responses * feat: add security page for managing access token settings * feat: add translations for token disabled banner * docs: replace superpowers spec/plan with consolidated disable-access-tokens doc * fix(api): rename error code DISABLE_AT_INSTANCE_LEVEL to DISABLED_AT_INSTANCE_LEVEL * perf(api): short-circuit disable check for service tokens in auth middleware * feat(api): restrict DISABLE_ACCESS_TOKENS to self-managed instances * feat: use Banner from propel components in instance disabled-banner * refactor: remove iconClassName prop from Banner propel component --------- Co-authored-by: b-saikrishnakanth <[email protected]>