The terminal's Sessions screen makes an API token with `m`: name and scope asked, the secret shown once #8092

Intent: an owner setting up an agent or a plugin gets a token without leaving the terminal; today the Sessions screen can revoke a token (d) but not make one.

Done looks like:

• [ ] The Sessions screen (src/tui/screens/signins.ts) offers m "make a token" to a signed-in person (not an agent): it asks a name (default token) and a scope ro/rw; admin is offered only to a site admin and needs a second explicit y naming that it acts as admin, as Settings' tick box does.
• [ ] It mints through the action createToken in src/actions/users.ts — the same path Settings uses — so token.created is emitted and ADMIN_TOKEN_WORDS is the refusal.
• [ ] The secret is shown once on a screen of its own with y to copy it and the words copy it now, it is never shown again.; leaving that screen forgets it — it is never in the list, a toast or a log.
• [ ] The new token appears in the list with never used.
• [ ] Tests (test/tui-token-make.test.ts): m mints an rw token and the list shows it; a non-admin is never offered admin; the secret is absent from the screen after esc. Each fails without the change.

Files: src/tui/screens/signins.ts, test/tui-token-make.test.ts

Risks: createToken says callers decide which credential may mint — the terminal session is held by an SSH key, a credential as strong as a browser session; a session reached through a token must not mint (say so in a comment and test it if the session records it). Leave docs/MCP.md and the API (hot) alone.

Brief: scout or mason.