feat(REQ-005): implement TrEx Basic V1 API contract with auth, assets, ledger, and user endpoints

- Add V1 API routes for assets, ledger, and user info with complete CRUD operations
- Implement authentication scopes and request validation via auth_routes.py
- Extend schemas with V1-specific models for accounts, holdings, and positions
- Add database queries and aggregations for P&L, performance, and account data
- Include comprehensive test coverage for all V1 endpoints and integration flows
- Update batch and release documentation with implementation and verification evidence
- Sync project structure and runtime flows per V1 API contract requirements

Closes implementation phase of BAT-001 (TrEx Basic V1 API Contract)

app/api/auth_routes.py

@@ -12,6 +12,8 @@ from app.schemas.auth import (
     AuthTokenResponse,
     CreateClientTokenRequest,
     IssuedClientTokenResponse,
+    IssueServiceTokenRequest,
+    IssueServiceTokenApiResponse,
     LoginRequest,
     TokenResponse,
 )
@@ -117,4 +119,26 @@ def revoke_token(
         service.revoke_token(auth_context, token_id)
     except ValueError as exc:
         _raise_auth_error(exc)
-    return Response(status_code=status.HTTP_204_NO_CONTENT)
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@router.post("/service-tokens", response_model=IssueServiceTokenApiResponse, status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_admin)])
+def issue_service_token(
+    payload: IssueServiceTokenRequest,
+    service: AuthService = Depends(get_auth_service),
+) -> IssueServiceTokenApiResponse:
+    try:
+        result = service.issue_service_token(
+            payload.name,
+            payload.username,
+            permission=payload.permission,
+            expires_in_days=payload.expires_in_days,
+            no_expiry=payload.no_expiry,
+        )
+    except ValueError as exc:
+        _raise_auth_error(exc)
+    return IssueServiceTokenApiResponse(
+        token=result.token,
+        runtime_id=result.auth_token.runtime_id,
+        auth_token=_to_auth_token_response(result.auth_token),
+    )