Service tokens

Bearer tokens issued to consuming projects (e.g. amet-depot) for authenticated access to /api/spatial/*. The plaintext is shown once on issue and never again.