API key security improvements

[goralczyks]

📃 Ticket

#318, #319

✍ Description

1. removed GET /api-token method
2. token created with POST /api-token consists of 2 parts:

• id
• confidential secret (stored in DB as hash)

3. user need to provide both parts for verification as single string in format: "id.secret": id is used to search user in DB, secret is verified against hash

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Files with missing lines	Coverage Δ
backend/oqtopus_cloud/common/models/user.py	100.00% <100.00%> (ø)
backend/oqtopus_cloud/user/routers/api_token.py	100.00% <100.00%> (ø)
backend/oqtopus_cloud/user/schemas/api_token.py	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[shgokita]

Here are two points of feedback:

• From a cryptographic strength perspective, please change the hash function from bcrypt to argon2id.
  Reference: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

• Regarding the GET /api-token API, I had planned to remove it, but since we want to retain the functionality to retrieve the expiration date, could you modify it to only return the expiration date as GET /api-token/status?