HF-2: rotate org-capable Hugging Face token for restart fallback

[Delqhi]

Problem

HF Spaces keep-alive is now installed and the fleet is healthy, but the current HUGGINGFACE_TOKEN only covers probe-only operation. Manual restart calls against https://huggingface.co/api/spaces/opensin-ai/<space>/restart still return authorization failures.

Why this matters

As long as the keep-alive cron keeps every Space warm, launch is unblocked.

But if a Space ever returns 5xx again, the workflow's fallback restart path will not be able to recover it autonomously until we rotate in a token with write access to the opensin-ai org Spaces.

Acceptance

• Store a Hugging Face user access token with write access to opensin-ai/* Spaces in SIN-Passwordmanager
• Fan out that token to Infra-SIN-OpenCode-Stack as HUGGINGFACE_TOKEN
• Verify POST /api/spaces/opensin-ai/a2a-sin-code-plugin/restart returns non-4xx
• Trigger the keep-alive workflow against an induced unhealthy state or a controlled manual restart and confirm recovery path works