feat(api): add REST API with scoped access tokens and OpenAPI docs

[maartenbode]

Closes #106.

Adds a versioned /api/v1 REST API for managing organizations, repositories, packages, members, invitations, mirrors, and access tokens, authenticated with a Bearer token (personal or organization-scoped).

• Introduces a TokenScope enum enforced per-route alongside the existing organization policies; tokens created before scopes existed keep full access, and the composer scope now gates registry access.
• Token settings let you choose scopes when creating a token and edit them afterwards, with an adaptive post-create dialog showing Composer and/or API usage.
• OpenAPI 3.1 spec auto-generated with Scramble (interactive docs at /docs/api, exported via composer api:docs).