Proposal tokens on the repository settings page: one line each with Revoke, and a mint form that shows the secret once #2147

Split from #2088, which could not start because #1831 is not on main. This waits for #1831's POST /api/v1/repos/:owner/:name/proposal-tokens to land.

Done looks like:

• [ ] Repository settings lists each proposal token in one line: child, origin, expires, last used, and a Revoke button (POST, same-origin check).
• [ ] A mint form creates one and shows its secret once, never again.
• [ ] Writer-only: a non-writer sees no section, and their POSTs are 403.
• [ ] Tests: mint, then list, then revoke, after which the revoked token's push is refused; the non-writer case.
• [ ] README: one paragraph on the page.

Files: the repository settings page under src/web/pages, src/actions/proposals.ts, a test. Brief: scout.