PROTM-2272: Add token lifecycle management (refresh/revoke/scopes/copy)

[sandshoes]

Summary

Extends the tokens namespace on TinybirdClient so it can manage tokens it didn't create, not just mint JWTs. Adds list(), get(nameOrId), revoke(nameOrId), refresh(nameOrId), updateScopes(nameOrId, scopes), and getValue(nameOrId), backed by new GET /v0/tokens, GET /v0/tokens/{name_or_id}, DELETE /v0/tokens/{name_or_id}, POST /v0/tokens/{name_or_id}/refresh, and PUT /v0/tokens/{name_or_id} calls. This brings SDK token support roughly to parity with tb token ls/rm/refresh/scopes/copy.

Linear issue: https://linear.app/tinybird/issue/PROTM-2272/typescript-sdk-add-token-lifecycle-management-refreshrevokescopescopy

The existing createJWT method/function is untouched.

Method names

• client.tokens.list() — GET /v0/tokens
• client.tokens.get(nameOrId) — GET /v0/tokens/{name_or_id}, result includes scopes (covers "scope inspection" — no separate scopes-only method was added since the get result already surfaces this)
• client.tokens.revoke(nameOrId) — DELETE /v0/tokens/{name_or_id}
• client.tokens.refresh(nameOrId) — POST /v0/tokens/{name_or_id}/refresh
• client.tokens.updateScopes(nameOrId, scopes) — PUT /v0/tokens/{name_or_id}
• client.tokens.getValue(nameOrId) — the "copy" equivalent (see below)

On "copy"

In the Forward CLI, tb token copy calls client.token_get(token_id) (i.e. the same GET /v0/tokens/{id} used for get/scope-inspection) and then does pyperclip.copy(token["token"]) — copying the raw secret value to the OS clipboard. Clipboard access isn't a meaningful SDK operation (no terminal/OS context, and headless/server environments have no clipboard), so this PR doesn't touch the OS clipboard at all. Instead, TokenInfo.value (mapped from the API's token field) is already populated whenever get()/list()/refresh()/updateScopes() expose it, and getValue(nameOrId) is a small convenience wrapper that just returns that string so callers can do whatever they need with it (store it, hand it to another service, etc.). It throws a TokenApiError if the token doesn't expose a raw value (e.g. the admin token).

Design notes

• New low-level methods were added to TinybirdApi in src/api/api.ts (listTokens, getToken, deleteToken, refreshToken, updateTokenScopes), mirroring the existing createToken method, and wrapped in src/api/tokens.ts with the same TokenApiConfig/TokenApiError pattern and contextual error messages as createJWT.
• updateScopes sends PUT /v0/tokens/{name_or_id} with a JSON body { scopes: [...] }, reusing the same { type, resource, filter } scope shape the get/list responses already return. (The legacy Python CLI client builds this as repeated scope=TYPE:resource:filter query params for old-style static tokens — a JSON body was chosen here for consistency with the JWT scope shape and because it's the more modern/idiomatic representation for a TS SDK.)

Test plan

• pnpm typecheck passes
• pnpm test:run passes (1088 tests, including new tests in src/api/tokens.test.ts and src/client/tokens.test.ts covering list/get/getValue/revoke/refresh/updateScopes, success and error paths)
• pnpm build succeeds
• CHANGELOG.md and package.json version untouched, per instructions

🤖 Generated with Claude Code