Add a read_all scope and explicit permanent tokens

An integration token used to be bound to the resource list that existed when it
was minted, so every new basemap needed a fresh token. read_all grants read on
every basemap and vector, including ones catalogued later, which is what an
internal consumer of the whole catalogue actually wants.

Tokens also gain a way to opt out of the default lifetime: expires_at accepts
never (or 0) in the API and the console, producing a token with no expiry.

The console shows blanket access as a badge instead of an empty grant list, and
the token form exposes both new options.

services/api-go/internal/basemap/vectors.go

@@ -584,6 +584,9 @@ func (s *Store) buildVectorDownloadURL(code string) string {
 }
 
 func (auth TokenAuth) CanReadVector(code string) bool {
+	if auth.CanReadAll() {
+		return true
+	}
 	group, ok := auth.VectorPermissions[readPermission]
 	if !ok {
 		return false