Permissions and token control

The free tools need no credentials. This build accepts only the fleet allow-list for domain requests. Files are processed in memory.

Tokens must be your own and read-only. The Door accepts no cloud roles or mailbox scopes. Tokens stored from your account are encrypted with Fernet; Revoke deletes the token row. Collection must be performed in the relevant sibling module with its documented scopes.