feat(pat): regenerate a token's secret and reset its expiry

POST /api/user/tokens/<id>/regenerate swaps the secret of an existing token
in place: name, scopes and restrictions stay, the old secret stops matching
at once, and the expiry is reset. The lifetime defaults to the one the token
was last issued with (clamped to today's policy) or to expires_in_days when
given. An expired token can be renewed this way; a revoked one cannot. It is
session only like the rest of token management, and writes a pat_regenerated
audit event. regenerated_at records the rotation.

docsgpt/alembic/versions/0032_personal_access_tokens.py

@@ -10,7 +10,8 @@ user can tell their tokens apart in the UI.
 itself). ``resource_filter`` optionally narrows a resource family to specific
 ids, e.g. ``{"agents": ["<uuid>"]}``; an absent family is unrestricted within
 the token's scopes. ``expires_at`` is NULL only when the operator allows
-non-expiring tokens.
+non-expiring tokens. Regenerating a token swaps its secret in place and stamps
+``regenerated_at``; the row, its name, scopes and restrictions stay.
 
 ``user_id`` is the auth ``sub``; no FK or trigger, mirroring ``devices`` and
 ``user_roles`` so a token row never blocks user deletion.
@@ -47,6 +48,7 @@ def upgrade() -> None:
             last_used_at    TIMESTAMPTZ,
             last_used_ip    TEXT,
             created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+            regenerated_at  TIMESTAMPTZ,
             revoked_at      TIMESTAMPTZ,
             revoke_reason   TEXT
         );