Rotate and delete API access, not just revoke

Rotating hands out a fresh token, voids the old one and lifts a revocation.
Deleting removes the row for good, taking its idempotency keys with it.
Both are admin only and land in the audit log.

messages/en.json

@@ -302,7 +302,10 @@
 			"runNotFound": "No matching message found in the channel. Does the bot still need channels:history?",
 			"channelRequired": "A bot token needs a channel, otherwise Logbuch has no target.",
 			"slackSaid": "Slack says: {detail}",
-			"windowReset": "The window is reset. The next digest covers the last seven days again."
+			"windowReset": "The window is reset. The next digest covers the last seven days again.",
+			"clientRotated": "The old token is void. The new one is shown here once.",
+			"clientDeleted": "The access is deleted.",
+			"clientUnknown": "That access no longer exists."
 		},
 		"errors": {
 			"nameRequired": "Enter a name.",
@@ -712,7 +715,13 @@
 				"project": "Without a binding the access covers all projects."
 			},
 			"publishTitle": "Publishing",
-			"publishHint": "No access may publish. That stays bound to accounts."
+			"publishHint": "No access may publish. That stays bound to accounts.",
+			"rotate": "New token",
+			"rotating": "Rotating",
+			"delete": "Delete",
+			"deleteConfirm": "Really delete?",
+			"deleting": "Deleting",
+			"keep": "Keep"
 		},
 		"recentEntries": "Recently edited",
 		"allEntries": "All entries",