feat: rework auth model with UserToken and Daedalus/Pallas integration

- Rename MCPToken to UserToken across models, views, and tests
- Update URL names from mcp-token-* to token-*
- Add Daedalus/Pallas integration design doc (v2)
- Switch docker-compose to build local mnemosyne:local image via shared
  build config instead of pulling from git.helu.ca

mnemosyne/library/api/workspaces.py

@@ -6,7 +6,8 @@ It uses the same Library node as a global library; the difference is that
 `workspace_id` is set, and search must filter on it.
 
 These endpoints are called by the Daedalus backend authenticated as the
-Mnemosyne user the workspace belongs to (per-user DRF token). The
+Mnemosyne user the workspace belongs to (per-user ``UserToken``,
+``Authorization: Bearer <plaintext>``, minted at ``/profile/tokens/``). The
 workspace's owning user is recorded on the Library node as
 ``owner_username``; every read and mutation is scoped to that user.
 Non-owners receive 404 so a workspace's existence isn't disclosed