fix(pat): align replay scopes, keep 404/405, retire expired names, document the PAT_ENABLED switch

The ASGI message events route now accepts the same scopes as its Flask
sibling (conversations:read or chat:run) through a shared constant. A token
request that fails routing gets Flask's 404/405 instead of a 403. Creating a
token retires an expired token that still held the name. allowed_ids uses
is_pat instead of a bare literal. PAT_ENABLED is documented as the master
switch it is: turning it off stops every existing token from authenticating.
The docs explain that sources are matched by name (oldest wins) and point CI
flows at sources upload --replace.

docsgpt/core/settings/auth.py

@@ -89,8 +89,10 @@ class AuthSettings(SettingsGroup):
     PAT_ENABLED: bool = Field(
         default=True,
         description=(
-            "Allow users to create personal access tokens. Tokens are only issued under AUTH_TYPE=oidc or "
-            "unset (None); simple_jwt and session_jwt have no stable user identity to bind a token to."
+            "Master switch for personal access tokens. When false, no token can be created AND every existing "
+            "token stops authenticating immediately (pipelines using them get 401); tokens are kept and work "
+            "again when re-enabled. Tokens are only available under AUTH_TYPE=oidc or unset (None); switching "
+            "to simple_jwt or session_jwt disables them the same way."
         ),
     )
     PAT_DEFAULT_LIFETIME_DAYS: int = Field(