Delete any existing token with the same name before creating a fresh one,
so that sha1 is always returned by the create response. The list API does
not return sha1 (Forgejo redacts it for security), making the old fallback
unreliable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>