buzz-db: move misplaced types to domain modules #12

Problem

Several types and helpers are defined at the bottom of `lib.rs` rather than in their domain modules:

• `ApiTokenRecord` struct (lines 5409–5431) — belongs in `api_token.rs`
• `AllowlistEntry` struct (lines 5434–5442) — belongs in a new `allowlist.rs` or in `relay_members.rs`
• `parse_api_token_row` function (lines 5446–5479) — belongs in `api_token.rs`
• `TokenSummary` struct (lines 652–665) — belongs in `api_token.rs`

Additionally, the allowlist operations (`is_pubkey_allowed`, `has_allowlist_entries`, `add_to_allowlist`, `remove_from_allowlist`, `list_allowlist` — ~100 lines inline in `lib.rs`) have no domain module.

Proposed change

• Move `ApiTokenRecord`, `TokenSummary`, and `parse_api_token_row` into `api_token.rs`
• Move `AllowlistEntry` and allowlist operations into `relay_members.rs` (they're closely related to membership) or a new `allowlist.rs`

Priority

Low — small cleanup, naturally done alongside #2 (lib.rs breakup).

🤖 AI review update (2026-08-23)

Do this as small #2 slices. Move API token records, parsing, methods, tests, and spans into api_token.rs. Put pubkey allowlist state in a dedicated allowlist.rs rather than relay_members.rs: authentication allowlisting and NIP-43 relay membership are separate policies even though both use pubkeys.