Add anvil registry token create|list|delete that consumes the new registry-token API (fangorn/anvil #347), so docker-login credentials can be provisioned from the CLI instead of only the web UI — e.g. the fangorn/fleet tofu deploy’s read-only pull:fangorn/* token.

• create --name <n> [--read] [--write] [--repo org/repo | --org org] [--scope ...] — flags expand to <action>:<org>/<repo|*>; –write implies pull+push; explicit –scope overrides. Prints the plaintext once.
• list — the caller’s tokens (no plaintext)
• delete <id> — revoke

Depends on anvil #347 (the API). Pure scope-building logic is unit-tested.

Acceptance

• the three subcommands call /api/v1/registry/tokens
• scope expansion covered by unit tests (read/org, write/repo, explicit, error cases)