Initial vibeproxy implementation

Self-contained HTTP/HTTPS/TCP/UDP reverse proxy manager written in Go,
with SQLite storage, a Bootstrap 5 admin UI (Go templates, no JS
framework), and a REST API under /api/v1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTXFrNP1imCW7jtfL5SZrw

internal/auth/apitoken.go

@@ -0,0 +1,34 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+)
+
+// GenerateAPIToken returns a full plaintext token (shown once to the user),
+// its sha256 hash (stored in the DB), and a short prefix (stored alongside
+// the hash so the UI can display "vp_ab12..." without ever re-showing the
+// secret).
+func GenerateAPIToken() (plaintext, hash, prefix string, err error) {
+	b := make([]byte, 32)
+	if _, err = rand.Read(b); err != nil {
+		return
+	}
+	secret := base64.RawURLEncoding.EncodeToString(b)
+	plaintext = "vp_" + secret
+	hash = HashAPIToken(plaintext)
+	prefix = plaintext[:8]
+	return
+}
+
+func HashAPIToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+func FormatTokenPreview(prefix string) string {
+	return fmt.Sprintf("%s%s", prefix, "…")
+}