feat: extend daemon model with daemon status tracking and list support

- Add daemon status tracking with state and metrics (idle, running, error)
- Implement pfhub daemon list CLI command for viewing registered daemons
- Extend auth schema and service for daemon lifecycle management
- Add postgres repository queries for daemon state persistence
- Expand test coverage for daemon registry and status transitions
- Update rel-006 release document with daemon model verification results
- Support daemon graceful shutdown and error recovery patterns

app/cli/commands/service_tokens.py

@@ -8,7 +8,7 @@ import typer
 
 from app.cli.core.output import mask_token_text, render_service_token_result
 from app.cli.core.utils import render_output
-from app.schemas.auth import AuthTokenResponse, ServiceTokenIssueCliResponse, ServiceTokenRevokeCliResponse
+from app.schemas.auth import AuthTokenResponse, ServiceTokenIssueCliResponse, ServiceTokenRebindCliResponse, ServiceTokenRevokeCliResponse
 from app.services.auth_service import AuthService
 
 token_app = typer.Typer(help="Service token lifecycle commands.")
@@ -42,6 +42,7 @@ def list_service_tokens(
                 token_prefix=t.token_prefix,
                 permission=t.permission,
                 token_type=t.token_type,
+                daemon_id=t.daemon_id,
                 expires_at=t.expires_at,
                 last_used_at=t.last_used_at,
                 revoked_at=t.revoked_at,
@@ -115,6 +116,30 @@ def rotate_service_token(
         ctx.obj.console.print(f"masked_token: {mask_token_text(issued.token)}")
 
 
+@token_app.command("rebind")
+def rebind_service_token(
+    ctx: typer.Context,
+    name: str = typer.Argument(..., help="Service token name to rebind."),
+    daemon_id: str = typer.Option(..., "--daemon-id", help="Existing daemon ID to bind to this token."),
+) -> None:
+    """Rebind an active service token to an existing daemon."""
+
+    def _rebind(service: AuthService, app_context):
+        return service.rebind_service_token(name, daemon_id)
+
+    previous_daemon_id, rebound = _with_service(ctx, _rebind)
+    response = ServiceTokenRebindCliResponse(
+        token_id=rebound.id,
+        name=name,
+        expires_at=rebound.expires_at,
+        revoked=rebound.revoked_at is not None,
+        runtime_id=rebound.runtime_id,
+        daemon_id=rebound.daemon_id,
+        previous_daemon_id=previous_daemon_id,
+    )
+    render_service_token_result(ctx.obj.console, ctx.obj.output_format, response)
+
+
 @token_app.command("revoke")
 def revoke_service_token(
     ctx: typer.Context,