Add a read_all scope and explicit permanent tokens

An integration token used to be bound to the resource list that existed when it
was minted, so every new basemap needed a fresh token. read_all grants read on
every basemap and vector, including ones catalogued later, which is what an
internal consumer of the whole catalogue actually wants.

Tokens also gain a way to opt out of the default lifetime: expires_at accepts
never (or 0) in the API and the console, producing a token with no expiry.

The console shows blanket access as a badge instead of an empty grant list, and
the token form exposes both new options.

services/api-go/internal/basemap/models.go

@@ -212,7 +212,9 @@ type CreateTokenInput struct {
 	BasemapCodes []string
 	VectorCodes  []string
 	Scopes       []string
-	ExpiresAt    *time.Time
+	// NoExpiry creates a token that never expires, overriding the default TTL.
+	NoExpiry  bool
+	ExpiresAt *time.Time
 }
 
 type TokenAuth struct {