Why

Registry tokens (docker-login credentials) could only be created in the web UI. Add a CLI, consuming the new registry-token API (fangorn/anvil #347), so automation can provision them — concretely, the fangorn/fleet tofu deploy needs a read-only pull:fangorn/* token for the droplet.

What

anvil registry token create --name <n> [--read] [--write] [--repo org/repo | --org org] [--scope ...]
anvil registry token list
anvil registry token delete <id>

• --read/--write + --repo/--org expand to <action>:<org>/<repo|*> scopes; --write implies pull+push; explicit --scope overrides.
• create prints the plaintext anvreg_... once; list never shows it; delete is id-scoped.

Example for the fleet token: anvil registry token create --name fleet-deploy --read --org fangorn → pull:fangorn/*.

Tests / checks

6 unit tests on the pure build_scopes logic (read/org, write/repo, explicit override, missing target, missing access, repo+org conflict). cargo fmt/clippy clean; full test suite green.

Depends on anvil #347 (the API) being deployed. Closes #31

🤖 Generated with Claude Code