API tokens

Credentials for things that are not a browser: git clone and git push over HTTPS, the marimo bench, scripts. Use one as the password in git clone https://you:TOKEN@… — the username is ignored.