Bind a worker's name and labels into its token; list and revoke tokens by jti

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/fluksio/models.py

@@ -566,3 +566,25 @@ class ConnectorState(SQLModel, table=True):
     key: str = Field(primary_key=True, max_length=200)
     value: str
     updated_at: datetime = Field(default_factory=get_datetime_utc, sa_type=UTCDateTime)
+
+
+# -----------------------------------------------------------------------------
+# Worker tokens
+#
+# What a superuser minted for a remote worker, so it can be listed and revoked.
+# The token itself is not stored: it carries its own name and labels, and this
+# row is how one is refused before it expires.
+# -----------------------------------------------------------------------------
+
+
+class WorkerToken(SQLModel, table=True):
+    """One worker credential, by the id it carries as `jti`."""
+
+    __tablename__ = "worker_token"
+
+    jti: str = Field(primary_key=True, max_length=32)
+    name: str = Field(max_length=255)
+    labels: list[str] = Field(sa_column=Column(JSON), default_factory=list)
+    created_at: datetime = Field(default_factory=get_datetime_utc, sa_type=UTCDateTime)
+    expires_at: datetime = Field(sa_type=UTCDateTime)
+    revoked_at: datetime | None = Field(default=None, sa_type=UTCDateTime)