fix: sensapp generate-token --help prints the help (CLI parsed with clap)

[fungiboletus]

What

• sensapp generate-token --help used to take --help as the token subject and print a valid token. The hand-rolled argument loop in src/main.rs is replaced by a clap derive parser, so -h/--help and --version work on the binary and on every subcommand, and typos in options are errors.
• New sensapp serve subcommand: the explicit name of what plain sensapp does. Plain sensapp still runs the server, so Docker and Helm are unaffected.
• clap 4 (derive) is a new dependency.

Why

A --help that mints a token is a footgun, and parsing arguments by hand is how it happened.

For the reviewer

• The server stays configured by SENSAPP_* env variables and settings.toml only. No new settings or flags.
• generate-token options are unchanged and every example in docs/JWT_AUTH.md still parses. --sensors "" still means an empty allow list (allows nothing), not an unrestricted token.
• The help does not need SENSAPP_JWT_SECRET.
• New tests/integration/cli.rs runs the real binary (7 tests, no database needed). Unit tests and cargo clippy --tests pass. sensapp serve was not run against a real database.

🤖 Generated with Claude Code