Add DB-backed application tokens for the update endpoint

apps/api/config/initializers/warp_engine.rb

@@ -2,6 +2,11 @@
 # értékadás (nem <<), hogy idempotens legyen.
 Rails.application.config.to_prepare do
   WarpEngine.configure do |c|
+    # A /update DB-tokenjeinek tulajdonosa. A :database módra váltás
+    # (c.update_secret_source = :database) csak azután jöhet, hogy a CI már
+    # DB-tokent használ — az átkapcsolás azonnal érvényteleníti az UPDATE_SECRET-et.
+    c.application_token_owner_class = "AdminUser"
+
     c.image_owners = [
       {
         label: "member",

apps/api/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_08_04_000002) do
+ActiveRecord::Schema[8.1].define(version: 2026_08_05_000001) do
   create_table "admin_users", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.datetime "created_at", null: false
     t.datetime "deleted_at", precision: 3
@@ -27,6 +27,23 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_04_000002) do
     t.index ["reset_password_token"], name: "index_admin_users_on_reset_password_token", unique: true
   end
 
+  create_table "application_tokens", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.datetime "created_at", precision: 3
+    t.datetime "deleted_at", precision: 3
+    t.datetime "expires_at", precision: 3
+    t.datetime "last_used_at", precision: 3
+    t.string "name", limit: 128, null: false
+    t.bigint "owner_id", null: false, unsigned: true
+    t.string "owner_type", limit: 128, null: false
+    t.json "scopes"
+    t.string "token_digest", limit: 64, null: false
+    t.string "token_prefix", limit: 12, null: false
+    t.datetime "updated_at", precision: 3
+    t.index ["deleted_at"], name: "idx_application_tokens_deleted_at"
+    t.index ["owner_type", "owner_id"], name: "idx_application_tokens_owner"
+    t.index ["token_digest"], name: "idx_application_tokens_token_digest", unique: true
+  end
+
   create_table "downloads", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.datetime "created_at", precision: 3
     t.datetime "deleted_at", precision: 3