fix(auth): refuse an API token while its owner is disabled or deleted

[remyluslosius]

v0.8 scope-freeze exception, approved 2026-09-25 (projects/openwatch/V0_8_0_READINESS). Fixes bugs/OW-071. No merge is authorized yet.

What was wrong

A disabled user's owk_ API token kept authenticating with its full role.

• Who it affects: only admin and security_admin hold token:write, so this is the offboarding case for the highest-privilege accounts.
• Why the workaround was partial: administrators can revoke any token, but the token list does not show a token's owner.

Change

This is P8 AC-95 only. AuthenticateToken joins the token's owner and refuses the token:

Owner state	Result	Audit reason on auth.login.failure
Disabled	401	api_token_owner_disabled
Soft-deleted	401	api_token_owner_deleted
None (created_by NULL)	401, fail closed	api_token_ownerless
Active	Authenticates as before

• It is a check, not a revocation. A refusal writes nothing to the token row, last_used_at included. Re-enabling the owner restores the token, and a token revoked through DELETE /api/v1/tokens/{id} stays revoked.
• Not included: P8's audit fields (service_token_effect, AC-97) and any change to the token list.

Contract, tests, docs

• Spec: system-api-tokens 1.1.0. C-02 amended; C-04 and AC-06 added.
• Audit contract: the three reasons are declared in audit/events.yaml, and the AC-80 vocabulary scan passes.
• AC-06, end to end: covers disabled, soft-deleted, ownerless, the active control, and re-enable. It reads each request's own audit row by correlation id, and checks the token row was not written.
• AC-02: its fixture now gives the token an active owner, because an ownerless token is refused by design.
• Mutation checks, each turning an AC-06 case red:
  • allow a deleted owner;
  • allow a disabled owner;
  • allow an ownerless token;
  • stamp last_used_at on a refusal;
  • collapse the binder reason;
  • implement the gate as a revocation.
• Docs:
  • the API guide's definition of an API token;
  • the incident runbook's credential table;
  • a CHANGELOG entry with an upgrade note: tokens with no owner stop authenticating, and the query to find them first is included.
• make spec-check passes (100%).

Not in this PR

bugs/OW-079, filed: a database failure during token lookup answers 401 rather than 503. It predates this change and is in the backlog under the interruption rule.

CHANGELOG.md may conflict trivially with the other v0.8 exception PRs.