feat: require embed tokens for /embed

Add token store and admin endpoints, update toolbox UI and embed page to use token-only configs, and refresh docs.
