Platform tokens (Settings → Tokens): platform API access without inference #166

Owner decision 2026-10-10. Part of #160.

• API Keys (existing): inference + platform API, only for tiers with inference.
• Tokens (new, below API Keys in user settings): nan_pat_ tokens for the platform API (runs, workspaces), never inference. Available to every member in good standing, so workspace-only members can use runs via API/CLI/webhooks.

Contract: hashed storage, shown once, max 10 per member, optional expiry, session-only management, deny-by-default route allowlist (/v1/runs*, GET /api/workspaces), never inference endpoints, live member checks.

Follow-ups: BYOK for members without inference (Phase 2, member Vault), CLI nan login --token.