fix(pat): align replay scopes, keep 404/405, retire expired names, document the PAT_ENABLED switch

The ASGI message events route now accepts the same scopes as its Flask
sibling (conversations:read or chat:run) through a shared constant. A token
request that fails routing gets Flask's 404/405 instead of a 403. Creating a
token retires an expired token that still held the name. allowed_ids uses
is_pat instead of a bare literal. PAT_ENABLED is documented as the master
switch it is: turning it off stops every existing token from authenticating.
The docs explain that sources are matched by name (oldest wins) and point CI
flows at sources upload --replace.

tests/api/test_asgi_auth.py

@@ -164,3 +164,19 @@ class TestPersonalAccessTokens:
         assert decoded is None
         assert error.status_code == 403
         assert json.loads(error.body)["error"] == "resource_not_allowed"
+
+    async def test_any_of_several_scopes_admits_the_token(self):
+        claims = dict(_PAT_CLAIMS, scopes=["conversations:read"])
+        with patch.object(asgi_auth, "handle_auth", return_value=claims):
+            decoded, error = await asgi_auth.authenticate(
+                _request(), pat_scope=("conversations:read", "chat:run")
+            )
+        assert error is None and decoded["sub"] == "alice"
+
+    async def test_message_events_accepts_the_same_scopes_as_message_tail(self):
+        from docsgpt.api import async_sse
+        from docsgpt.api.pat import rules
+
+        tail = rules.RULES[("/api/messages/<string:message_id>/tail", "GET")]
+        assert tail.scopes == rules.MESSAGE_REPLAY_SCOPES
+        assert async_sse.MESSAGE_REPLAY_SCOPES is rules.MESSAGE_REPLAY_SCOPES