feat: add wildcard token support for allowed extensions and access token CLI commands

Introduce WILDCARD_TOKENS set in attachments.py to treat "*", ".*", "*.*" as wildcards that fall back to ALLOWED_UPLOAD_TYPES. Add cmd_token_issue and cmd_token_list CLI commands for issuing and listing DevPlace access tokens. Register access_tokens table in SOFT_DELETE_TABLES and initialize its columns and indexes in init_db. Replace Form() with Depends(json_or_form(...)) in admin backup, container, notification, settings, and user routers to support both JSON and form data.

devplacepy/routers/reactions.py

@@ -2,25 +2,25 @@
 import logging
 from typing import Annotated
 from datetime import datetime, timezone
-from fastapi import APIRouter, Request, Form
+from fastapi import Depends, APIRouter, Request
 from fastapi.responses import RedirectResponse, JSONResponse
 from devplacepy.database import get_table, db, _now_iso
 from devplacepy.utils import generate_uid, require_user, track_action
 from devplacepy.models import ReactionForm
 from devplacepy.services.audit import record as audit
+from devplacepy.dependencies import json_or_form
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
 REACTABLE: set[str] = {"post", "comment", "gist", "project"}
 
-
 @router.post("/{target_type}/{target_uid}")
 async def react(
     request: Request,
     target_type: str,
     target_uid: str,
-    data: Annotated[ReactionForm, Form()],
+    data: Annotated[ReactionForm, Depends(json_or_form(ReactionForm))],
 ):
     user = require_user(request)
     if target_type not in REACTABLE: