[FEATURE] Scoped read keys per registered client

## Summary

Allow each registered client application to have its own read token that scopes `GET /api/logs` to only its own entries, enabling multiple teams to share one logstream-server instance without seeing each other's logs.

## Motivation

Currently `UI_SECRET` is a single shared key that can read all entries from all applications. In a multi-team environment this is a security and privacy concern.

## Proposed changes

### Schema

```sql
ALTER TABLE clients
ADD COLUMN read_token VARCHAR(255) NULL DEFAULT NULL;
```

Generated the same way as `api_token` (32 random bytes, URL-safe base64). Returned once via `POST /api/clients/{app_key}/rotate-read-token`.

### Auth behaviour

| Token type | Can read |
|------------|----------|
| `UI_SECRET` (admin) | All entries, no `app_key` filter forced |
| `read_token` (scoped) | Only entries where `app_key` matches the client's registered key |

When a scoped read token is used, the `app_key` filter is **forced** server-side — the client cannot override it.

### New endpoint

`POST /api/clients/{app_key}/rotate-read-token` — generate and return a new scoped read token (shown once).

## Acceptance criteria

- [ ] `read_token` column added via migration
- [ ] Scoped token generated and returned once via new endpoint
- [ ] `GET /api/logs` with scoped token only returns entries for that `app_key`
- [ ] `GET /api/logs/{id}` with scoped token returns 403 for entries from other apps
- [ ] Admin `UI_SECRET` behaviour unchanged
- [ ] `GET /api/info` reflects scoped vs admin capability
- [ ] Unit and integration tests
- [ ] Documentation updated

Start by locating the clients schema and migration, then trace the existing api_token and UI_SECRET authentication flows for POST /api/clients/{app_key}/rotate-read-token, GET /api/logs, GET /api/logs/{id}, and GET /api/info. Add the scoped-token behavior, migration, unit and integration tests, and documentation described in the acceptance criteria; done means admin behavior is unchanged and scoped tokens cannot access other clients' entries.

Written by the indexing model from the issue text.