nx_apistack_svctoken.nx

nx_apistack_svctoken.nx -- CAP-API-SVCTOKEN: scoped machine-to-machine tokens for /api (service accounts that aren't a human OPAQUE login). A token store maps HASH(token) -> service + level (svctokens.conf: tokenhex TAB service TAB level), so the store holds only HASHES -- a leaked store never reveals a usable token (the sovereign exceed over plaintext API keys). st_resolve hashes the presented token and looks it up; deny-by-default. Scope = the same DATA-driven level as the roles SSOT, so a service token is level-scoped exactly like a user. license_tier: ORIGINAL