fix(pat): align replay scopes, keep 404/405, retire expired names, document the PAT_ENABLED switch

The ASGI message events route now accepts the same scopes as its Flask
sibling (conversations:read or chat:run) through a shared constant. A token
request that fails routing gets Flask's 404/405 instead of a 403. Creating a
token retires an expired token that still held the name. allowed_ids uses
is_pat instead of a bare literal. PAT_ENABLED is documented as the master
switch it is: turning it off stops every existing token from authenticating.
The docs explain that sources are matched by name (oldest wins) and point CI
flows at sources upload --replace.

docsgpt/storage/db/repositories/personal_access_tokens.py

@@ -87,6 +87,23 @@ class PersonalAccessTokensRepository:
             {"user_id": user_id},
         ).scalar_one()
 
+    def retire_expired_name(self, user_id: str, name: str) -> int:
+        """Revoke an expired token holding ``name`` so the name can be reused.
+
+        An expired token can no longer authenticate but keeps ``status = 'active'``,
+        and the unique index on live names would otherwise reserve its name forever.
+        """
+        result = self._conn.execute(
+            text(
+                "UPDATE personal_access_tokens "
+                "SET status = 'revoked', revoked_at = now(), revoke_reason = 'expired' "
+                "WHERE user_id = :user_id AND name = :name AND status = 'active' "
+                "AND expires_at IS NOT NULL AND expires_at <= now()"
+            ),
+            {"user_id": user_id, "name": name},
+        )
+        return result.rowcount
+
     def name_in_use(self, user_id: str, name: str) -> bool:
         return (
             self._conn.execute(