fix: API tokens use the mos_ prefix [CI]

backend/src/MoShiro.Backend.Application/Auth/AuthService.cs

@@ -140,7 +140,7 @@ public sealed partial class AuthService
             return ValidationError.Fail<CreatedApiToken>("scope", "must be read, admin or release");
         }
 
-        string plaintext = TokenHash.NewToken("mon");
+        string plaintext = TokenHash.NewToken("mos");
         var record = new ApiTokenRecord(Ulid.NewPrefixed("tok", _time), name, scope, TokenHash.Sha256(plaintext), _time.GetUtcNow().ToUnixTimeMilliseconds(), null, null);
         await _store.CreateApiTokenAsync(record, ct);
         return Result<CreatedApiToken>.Ok(new CreatedApiToken(record, plaintext));

backend/tests/MoShiro.Backend.Tests/ApiBasicsTests.cs

@@ -139,7 +139,7 @@ public sealed class ApiBasicsTests
         Assert.Equal(HttpStatusCode.OK, read.StatusCode);
 
         using HttpClient bogus = _backend.NewClient();
-        bogus.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "mon_bogus");
+        bogus.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "mos_bogus");
         using HttpResponseMessage unknown = await bogus.GetAsync("/api/admin/agents");
         Assert.Equal(HttpStatusCode.Unauthorized, unknown.StatusCode);
     }