fix(admin): bind token form to dotted scope to escape ng-if child scope

The Generate button silently no-op'd because ng-model="newTokenName" inside
an ng-if block wrote to a child scope, leaving $scope.newTokenName empty.
Use $scope.tokenForm.{name,plaintext} so prototypal lookup resolves to the
controller scope.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

public/partials/admin/user.htm

@@ -81,14 +81,14 @@
     <p class="paper-page-lede">Personal API tokens for this admin account. Send as <code>Authorization: Bearer &lt;token&gt;</code> to authenticate without GitHub OAuth (useful for development).</p>
 
     <form ng-submit="createToken()" class="d-flex" style="gap: 8px; margin-bottom: 12px;">
-      <input type="text" class="form-control" ng-model="newTokenName" placeholder="Token name (e.g. dev-laptop)" required />
+      <input type="text" class="form-control" ng-model="tokenForm.name" placeholder="Token name (e.g. dev-laptop)" required />
       <button type="submit" class="btn btn-primary"><i class="fas fa-plus"></i> Generate</button>
     </form>
 
-    <div ng-if="newTokenPlaintext" class="alert alert-warning" role="alert">
+    <div ng-if="tokenForm.plaintext" class="alert alert-warning" role="alert">
       <strong>Copy this token now — it will not be shown again:</strong>
-      <pre style="white-space: pre-wrap; word-break: break-all; margin: 8px 0 0; font-family: var(--font-mono); font-size: 0.85rem;">{{newTokenPlaintext}}</pre>
-      <button class="btn btn-sm" ng-click="newTokenPlaintext = null">Dismiss</button>
+      <pre style="white-space: pre-wrap; word-break: break-all; margin: 8px 0 0; font-family: var(--font-mono); font-size: 0.85rem;">{{tokenForm.plaintext}}</pre>
+      <button class="btn btn-sm" ng-click="tokenForm.plaintext = null">Dismiss</button>
     </div>
 
     <div class="paper-table w-100" ng-if="tokens.length">

public/script/admin.js

@@ -199,8 +199,7 @@ angular
       getUserRepositories($routeParams.username);
 
       $scope.tokens = [];
-      $scope.newTokenName = "";
-      $scope.newTokenPlaintext = null;
+      $scope.tokenForm = { name: "", plaintext: null };
 
       function loadTokens() {
         $http.get("/api/admin/tokens").then(
@@ -215,13 +214,13 @@ angular
       loadTokens();
 
       $scope.createToken = () => {
-        if (!$scope.newTokenName) return;
+        if (!$scope.tokenForm.name) return;
         $http
-          .post("/api/admin/tokens", { name: $scope.newTokenName })
+          .post("/api/admin/tokens", { name: $scope.tokenForm.name })
           .then(
             (res) => {
-              $scope.newTokenPlaintext = res.data.token;
-              $scope.newTokenName = "";
+              $scope.tokenForm.plaintext = res.data.token;
+              $scope.tokenForm.name = "";
               loadTokens();
             },
             (err) => console.error(err)