feat: self-service worker enrollment bound to a user account

Let a signed-in user turn their own machine into a worker without the
shared token. The coordinator already binds a JWT-authenticated
registration to owner_id as untrusted; this adds the missing pieces.

userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest)
with create/list/revoke and a public /worker-tokens/exchange that trades
a key for a short-lived JWT carrying the owner current role/verified.

python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token
provider exchanges the key and refreshes the JWT proactively and on 401,
so a long-running worker survives token expiry. Static bearer token path
is unchanged.

coordinator UI: an "add your machine" page that mints a key and shows a
ready-to-run command, proxying key management to the userservice; the
dashboard gains an owner-scoped "my machines" section.

docs: how to run a worker from your account, plus the untrusted/quorum/
verified trust model.

users/migrations/0003_worker_keys.up.sql

@@ -0,0 +1,31 @@
+BEGIN;
+
+-- A worker key is a long-lived credential a user creates to run a worker on
+-- their own machine. Unlike the 24h login JWT, it does not expire on its own:
+-- the worker presents it to /worker-tokens/exchange to mint a short-lived JWT
+-- and refreshes as needed. Only a SHA-256 hash is stored, never the key itself,
+-- so a database leak cannot be replayed as a credential.
+CREATE TABLE worker_keys (
+    id           uuid        PRIMARY KEY,
+    user_id      uuid        NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    -- Human label so a user can tell their machines apart when revoking.
+    name         text        NOT NULL,
+    -- Hex SHA-256 of the presented key. The key is high-entropy, so a fast hash
+    -- is enough — no per-key salt or bcrypt cost is needed here.
+    token_hash   text        NOT NULL,
+    -- The leading, non-secret slice of the key, shown in the UI to identify a
+    -- row without ever revealing the secret again.
+    prefix       text        NOT NULL,
+    created_at   timestamptz NOT NULL DEFAULT now(),
+    -- Last successful exchange; NULL until first use.
+    last_used_at timestamptz,
+    -- Set when the user revokes the key; a revoked key never exchanges again.
+    revoked_at   timestamptz,
+
+    CONSTRAINT uq_worker_keys_token_hash UNIQUE (token_hash)
+);
+
+-- Listing and revoking are always scoped to one owner's live keys.
+CREATE INDEX ix_worker_keys_user_active ON worker_keys (user_id) WHERE revoked_at IS NULL;
+
+COMMIT;