[Feature Request] Machine-friendly auth for host-group management API

Context

I'm using Ansible to automate the full lifecycle of PatchMon agents across a large fleet —
enrollment, configuration, service setup, and host-group assignment. The enrollment part works
great thanks to the auto-enrollment token mechanism.

However, host-group management (POST /api/v1/host-groups, PUT /api/v1/hosts/:id/groups)
currently requires a Bearer JWT from a logged-in user, which is problematic in an automated
context:

• JWTs are short-lived (session-scoped), so they can't be stored statically in automation
  secrets (e.g. Ansible Vault)
• The only workaround is to authenticate via POST /api/v1/auth/login at playbook runtime,
  which requires storing admin credentials — a larger blast radius than a scoped token
• There is no way to generate a long-lived, revocable API token scoped to group management
  operations

Feature Request

One of the following would fully solve this for automation use cases:

Option 1 — Long-lived API tokens (preferred)

Allow admin users to generate long-lived, revocable API tokens from the UI
(Admin → API Tokens), usable as Bearer tokens for all authenticated endpoints.
Similar to GitHub personal access tokens or GitLab project access tokens.

Option 2 — Extend auto-enrollment token scope

Allow auto-enrollment tokens to optionally cover the host-group endpoints
(/api/v1/host-groups, /api/v1/hosts/:id/groups), since the enrolling agent already
has an established trust relationship with the server.

Option 3 — Dedicated host-group management token

Introduce a credential type scoped specifically to host-group CRUD operations,
without requiring a full admin user session.

Why it matters

Without one of the above, fully unattended deployments must either:

• Re-authenticate at every playbook run using stored admin credentials, or
• Manually copy a short-lived JWT from a browser session before each run

Both are unacceptable for production automation workflows. A static, scoped, revocable token
would make PatchMon a first-class citizen in any IaC/GitOps/Ansible pipeline.