fix(pat): align replay scopes, keep 404/405, retire expired names, document the PAT_ENABLED switch

The ASGI message events route now accepts the same scopes as its Flask
sibling (conversations:read or chat:run) through a shared constant. A token
request that fails routing gets Flask's 404/405 instead of a 403. Creating a
token retires an expired token that still held the name. allowed_ids uses
is_pat instead of a bare literal. PAT_ENABLED is documented as the master
switch it is: turning it off stops every existing token from authenticating.
The docs explain that sources are matched by name (oldest wins) and point CI
flows at sources upload --replace.

tests/api/test_pat_rules.py

@@ -114,6 +114,11 @@ class TestScopeEnforcement:
         response = _call(client, "GET", "/api/admin/users", _claims(list(SCOPES)))
         assert _denied(response) == "not_available_to_tokens"
 
+    def test_unknown_path_and_wrong_method_keep_their_own_status(self, client):
+        claims = _claims(list(SCOPES))
+        assert _call(client, "GET", "/api/no_such_route", claims).status_code == 404
+        assert _call(client, "DELETE", "/api/get_agents", claims).status_code == 405
+
     def test_missing_scope_is_refused_and_names_the_scope(self, client):
         response = _call(client, "GET", "/api/get_agents", _claims(["sources:read"]))
         assert _denied(response) == "insufficient_scope"