Settings > API: token changes wait for Save, curl example with the token

Adding or revoking an API token is now pending like the other settings:
Save applies it, Cancel drops it. After Save each new token is shown once
with a copy button, and the curl example uses it, highlighted, with its
own copy button.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

README.md

@@ -364,7 +364,7 @@ Access goes through an **API token**, created in *Settings > API* by an administ
 as `Authorization: Bearer lst_…`. A token is read-only and only opens `/api/v1/`; it works
 whatever the [authentication](#authentication) mode (`local`, `oidc`, or none). It is shown once,
 when it is created: LogStream only keeps its SHA-256 hash, in `/data/api_tokens.json`.
-Revoking it cuts off access at once; the list shows when and from where each token was last
+Revoking it (then Save) cuts off access at once; the list shows when and from where each token was last
 used. A logged-in browser session can call the route too.
 
 | Parameter | Meaning |
@@ -429,7 +429,7 @@ The gear icon opens the settings, organized in tabs. Changes show at once but ar
 with the **Save** button, under the tab labels: it takes the accent color while changes are
 waiting. **Cancel** goes back to the saved settings, and closing the window with unsaved changes
 asks before dropping them. Localization and Appearance are remembered per browser; color tags
-and log sources are saved on the server. Purging, API tokens and resetting column widths act at once.
+and log sources are saved on the server. Purging and resetting column widths act at once.
 
 - **Localization**
   - *Language*: English or French.
@@ -477,9 +477,11 @@ and log sources are saved on the server. Purging, API tokens and resetting colum
   (already set in `docker-compose.yml`). The feature is off by default: set `ALLOW_PURGE=true`
   to allow it. Any admin can then purge: turn on [authentication](#authentication) if the UI
   is reachable by others.
-- **API**: API tokens for the [reading API](#reading-api-n8n-scripts): create one with a name
-  (shown once, copy it then), see when and from where each was last used, revoke it. Reserved
-  to administrators.
+- **API**: API tokens for the [reading API](#reading-api-n8n-scripts): add one with a name,
+  revoke one, see when and from where each was last used. Additions and revocations wait for
+  **Save** like the other settings (**Cancel** drops them). After Save, each new token is shown
+  once with a copy button, and the curl example below uses it, highlighted, with its own copy
+  button. Reserved to administrators.
 
 ## Authentication