Remove User.api_v2_token property

[casds-FDXS]

Description

• Remove the User.api_v2_token property that returned the plaintext DRF API token.
• Remove the now-unused Token import from the user model.
• Update the download API tests to query the DRF Token model explicitly when constructing the authorization header.

This preserves the existing test authentication behavior while removing the plaintext token access path from the general-purpose User model.

Testing:

• docker compose run --rm web uv run python manage.py test apps.downloads.tests.test_views

  • 78 tests passed.

• docker compose run --rm web uv run ruff format --check apps/users/models.py apps/downloads/tests/test_views.py

  • 2 files already formatted.

• docker compose run --rm web uv run ruff check --ignore EXE002 apps/users/models.py apps/downloads/tests/test_views.py

  • All checks passed.

Closes

• Fixes Hardening: [low-priority] Remove User.api_v2_token property (returns plaintext API token) #3047