[snyaggarwal]

Refs OpenConceptLab/ocl_online#201. Goes with OpenConceptLab/oclapi2#991, which makes map project tokens write-only: the API stores them apart and returns has_token: true in their place.

Changes

• Custom algorithms: when a token is saved but not entered this session, the token field is required and says why. Changing the URL clears has_token, as the API drops a token whose URL changes.
• Auto Match and single-row matching stop with a warning naming the algorithm when a custom algorithm's saved token hasn't been entered this session, in place of failing every row with a 401.
• Lookups: for an OCL API lookup (no URL, a path, or the API's origin), the token field explains that the user's own sign-in is used and a token there isn't saved. For another host, it says a token is saved and must be entered again. Changing the URL clears has_token.
• Copy project: the copy starts without the original's tokens or has_token.
• buildConfigSnapshot leaves out every token from the run snapshot.
• New helpers in tokenScope.js: isOCLAPILookupURL, needsSessionToken, withoutTokens. New strings in en, es, pt-BR and zh.

Not in this PR

• A lookup on a non-OCL host whose saved token isn't entered this session still fails its requests; only the field hint warns.

Tests

• npm test: 662 pass, including new tests for the helpers and the snapshot. npm run eslint: clean.
• Not checked in a running Mapper against oclapi2#991.

🤖 Generated with Claude Code

[snyaggarwal]

Reviewed with OpenConceptLab/oclapi2#991 at the current heads. One UI finding below. I did not run tests or lint locally, per request.

[snyaggarwal]

Rereviewed with OpenConceptLab/oclapi2#991. The earlier P3 is addressed: URL blur skips unauthenticated verification for a saved token, and the removal action remains visible alongside an authentication error. I found no further actionable findings or nits in this pass. I did not run tests or lint locally, per request.