Migrate to JWT

Currently we use the very basic auth scheme, [TokenAuthentication](https://www.django-rest-framework.org/api-guide/authentication/#tokenauthentication) (at least that's the name used in Django REST framework).

This has several downsides:
- the token never changes (bad security)
- AuthHandler middleware has to query database for every call

JWT would let us solve these problems.

Start by locating the current Django REST framework TokenAuthentication configuration and the AuthHandler middleware mentioned in the issue. Trace how tokens are issued and checked, then define the JWT migration boundaries; done means authentication uses JWT and the per-request database lookup is no longer required.

Written by the indexing model from the issue text.