Project tokens for the Lens MCP endpoint.

The public token id (plt_…) is safe to list. The secret (lns_…) is shown once and stored only as a SHA-256 hash. Authenticate with Authorization: Bearer <secret> (optionally plt_…:lns_…).