#3768 auth login leaves a new active API token per login; no cleanup process

Problem

Each swamp auth login creates a new cli-<host>-<epoch-ms> API token. Old tokens stay active. swamp auth logout revokes only the stored key, so re-login without logout, or a wiped credential store, orphans the old token.

Observed on one account: 10 active tokens, 8 unused for 14+ days, oldest created May 2026, all from the same host. Revocation today is manual, one token at a time, in the web UI.

Options

1. Idle expiry (server-side). Tokens unused for N days (default 90) expire automatically. Optional per-account setting. Fixes orphans from any cause. Needs a server change.
2. Reuse or replace on login (CLI). Before creating a token, login revokes the prior stored key, or reuses the existing token for the same host label. Stops growth at the source. Cannot clean tokens whose local store is already gone.
3. Explicit prune command. swamp auth token prune --unused-days N [--dry-run] revokes the account's CLI tokens idle for N days. Opt-in, scriptable, works on existing backlog.
4. Absolute lifetime. Fixed TTL per token (for example 1 year) with re-login prompt. Simple, but forces re-auth for active tokens.
5. Stable per-host token name. Use cli-<host> without the timestamp so a second login conflicts or replaces instead of adding. Smallest change, weak alone.

Recommendation

Option 2 plus option 1. Option 2 stops new orphans. Option 1 cleans the rest. Option 3 is a cheap interim step for the existing backlog.

Related

• auth logout already revokes the stored key. No path exists for tokens whose local copy is gone.