feat(fs): manage owner and scoped file system tokens

[Icemap]

Summary

• add owner token generation and path-and-operation-limited scoped token issuance for TiDB Cloud Filesystem
• allow TI_FS_TOKEN and --fs-token to carry either owner or scoped credentials, with backend-enforced capability boundaries
• add token list, enable, disable, delete, and self-refresh workflows with optional atomic local credential selection and rotation
• preserve authoritative scoped metadata locally without treating local state as the remote token inventory
• protect active local mounts from destructive token changes and provide owner/scoped-specific authentication and authorization errors
• update README, agent guidance, the completed 0030 specification, unit tests, black-box e2e, and live e2e

Validation

• make test
• make e2e
• TI_E2E_BIN="$PWD/bin/ti" TI_LIVE=1 TI_PROFILE=live-e2e go test ./e2e -count=1 -v -timeout 15m -run '^TestLiveFSFileSystemTokenLifecycle$'
• git diff --check

The live lifecycle verifies owner-to-scoped issuance, in-scope access, out-of-scope rejection, scoped self-refresh, denial of scoped token-management and child-issuance operations, and cleanup.