Closes #234, both halves, on the decision that nothing should be SSH-only as the forge matures.
The flag is gone. =Command.SSHOnly= and the dispatcher check that refused a command arriving over HTTP are removed, with the 32 registrations that set it: build secrets, mirror credentials, API tokens, web sessions, deploy keys, the audit log, quotas and instance administration. What a caller may do is now decided in one place for every door — the account's rights, narrowed by the scope of the key or token the request came with.
What changes in practice. A full-scope API token can now do anything its owner can, minting another token included; a read-scoped one still cannot write, since minting is a write. The runner protocol still needs a key session, by mechanism rather than by flag: a build is claimed by a key, so a token request is told so plainly. Secrets keep travelling on stdin wherever they are set, because argv is world-readable in =/proc= and the audit log keeps flag values. Operators should review the tokens they have issued and re-mint as =--scope read= any that only need to read; the changelog says so too.
The first page it unlocks. =/admin/users=: the account list with the state filter and keyset cursor =admin user list= takes, and promote, demote, disable and enable per row, each dispatching the command. Demote and disable ask for the username to be typed. Account creation and deletion, invites and address assertion stay on the command line — one takes a key, the others mint a credential or cannot be undone. A non-admin gets the 404 a missing page would.
Docs: the Parity rule is rewritten (a =no= is now a page nobody has built, not a refusal), "SSH only, by design" becomes "CLI only, for now", a new Administration table lands, and the API, Threat-Model, Admin, Users, Home and README passages that promised the old rule are corrected.
Tests: =e2e/adminusersweb_test.go= drives the page including the last-admin refusal and the typed-name check; =e2e/api_test.go= now asserts a full-scope token can mint one. Verified by hand on a local instance in both colour schemes.