feat(jetstream): enable read-only personal access tokens

[vcnainala]

Summary

• Enable Jetstream Features::api() so verified users can manage personal access tokens at /user/api-tokens (account menu → Personal Access Tokens).
• Restrict Sanctum PAT abilities to read only; default new tokens to read.
• REST API authorization is unchanged: Lomkit policies + Spatie permissions (delete_molecule, etc.), not Sanctum ability middleware.

Test plan

• phpunit --filter=ApiToken (3 tests)
• Log in as verified user → create PAT → use Authorization: Bearer <token> on GET /api/molecules
• Confirm token UI shows only read permission
• Confirm DELETE /api/molecules returns 403 for users without Spatie delete permissions

Resolves

Closes #744

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 6.08%. Comparing base (a4c26c6) to head (aae0217).
⚠️ Report is 4 commits behind head on development.

Additional details and impacted files

@@               Coverage Diff                @@
##             development    #793      +/-   ##
================================================
- Coverage           6.14%   6.08%   -0.07%     
- Complexity          1736    1737       +1     
================================================
  Files                227     227              
  Lines               8945    8956      +11     
================================================
- Hits                 550     545       -5     
- Misses              8395    8411      +16     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.