GET    /api/{plural}/{slug}/tokens             list consumer names
POST   /api/{plural}/{slug}/tokens             { consumer, token? }  → returns token ONCE
DELETE /api/{plural}/{slug}/tokens/{consumer}  revoke