README: explain listing and replacing CI machine tokens #583

The problem

The README tells users to replace an expiring machine token by creating another one, updating CI and running sotto token revoke, but it does not show the required token-ID argument or how to identify that ID. It also omits the existing sotto token ls --json output.

A short walkthrough would let someone replace CI credentials without guessing whether the revoke argument is the token's label, its ID or the secret SOTTO_TOKEN value.

Proposed approach

Expand the machine-token paragraph beside the team quick start into a concise inspection and replacement guide. Document the current commands; no CLI or server changes are needed.

Acceptance criteria

• Show sotto token ls, sotto token ls --json and sotto token revoke <token-id>, explaining that the ID comes from the listing and is not the token's name or secret value.
• Explain that management uses the logged-in user's access and the configured active environment. Include one consistent sotto --env <environment> token ... example so readers can target the intended environment; organisation token management requires admin/owner access.
• Explain that listings contain active token metadata, not recoverable credentials: revoked/expired tokens are omitted, and the credential printed on creation cannot be retrieved by listing. For JSON, briefly describe token_id, name, creator/beneficiary metadata and expiry fields; use only synthetic data if including a sample.
• Give the sequence for replacement: identify the old ID, create a replacement, save/update the CI secret and verify CI uses it, then revoke the old ID. Preserve the existing lifetime guidance rather than duplicating it inconsistently.
• Explain that revocation stops API authentication and does not itself rotate the environment key. Reference the CLI's existing sotto rotate guidance for organisation environments without implying that either command can erase previously copied plaintext.
• Update the corresponding sections in the README translations, keeping commands and structure aligned. Run scripts/check-readme-i18n and check examples against current CLI help/source.

Evidence and starting points

Verified by source inspection on main 355a3a52fa17742bc70489575a4f28e378f822ff, in a clean isolated checkout on macOS arm64:

• README.md: the machine-token paragraph mentions listing and revocation but has no management example or JSON explanation.
• crates/cli/src/main.rs: TokenCommand, token_command, machine_token_list_json, and the global environment override.
• crates/server/src/machine.rs: list_tokens filters active tokens; revoke_token revokes API access separately from key rotation.

This is a documentation gap, not a reported runtime failure. No live token was created, listed or revoked during investigation. Existing open/closed issues and open PRs were checked: #328 added JSON output and #512 added expiry fields, while this task explains the user workflow around those existing features.

Keep the PR to documentation and use British English and plain hyphens as required by CONTRIBUTING.md. Sign off commits with git commit -s.