fix: restore access token hash navigation

[alloutflo]

Summary

• restore navigation to the repository access-token section from the existing settings links
• handle both an initial #access-tokens fragment and later hash changes
• add focused lifecycle tests for matching, non-matching, updated, and cleaned-up hash listeners

Root cause

The existing Next.js links already target #access-tokens, and the target section already has that ID. However, the section lives in the client-rendered, data-dependent AccessTokenManagement component. The browser can process the fragment before that component is mounted, and there was no client-side handler to retry the scroll once the target existed or when the hash changed later.

Fix

useHashScroll checks the current fragment after the component mounts, subscribes to hashchange, scrolls only when the requested target matches, and removes the listener on unmount. It runs directly inside AccessTokenManagement, so the target element is present when the initial effect runs. The existing next/link destinations remain unchanged.

Validation

• npm test -- --runInBand src/hooks/useHashScroll.test.ts — 4 focused tests passed
• npm test -- --runInBand — 35 tests across 8 suites passed
• npx tsc --noEmit --pretty false — passed
• targeted ESLint — 0 errors; one pre-existing React Hook Form watch() compatibility warning in AccessTokenManagement
• targeted Prettier — passed
• git diff --check, including both new files — passed

The repository-wide lint baseline remains red with 97 errors and 19 warnings in pre-existing code; the changed paths introduce no new lint errors. A production build could not complete in the constrained local environment because the build exhausted the available disk space (ENOSPC); it stopped without a BUILD_ID and without a code-related diagnostic. Playwright was not run because its authenticated stack was not available within that resource limit. No browser or human validation is claimed.

AI assistance

AI assistance was used for issue analysis, implementation, and test drafting. The diff and the automated checks listed above were inspected locally; no manual browser validation is claimed.

Fixes l3montree-dev/devguard#2802