Edits write straight to this app's token override file — dev-only, no undo.
[GET] "/api/tokens": 403 Token editor is dev-only.