feat(pat): regenerate a token's secret and reset its expiry

POST /api/user/tokens/<id>/regenerate swaps the secret of an existing token
in place: name, scopes and restrictions stay, the old secret stops matching
at once, and the expiry is reset. The lifetime defaults to the one the token
was last issued with (clamped to today's policy) or to expires_in_days when
given. An expired token can be renewed this way; a revoked one cannot. It is
session only like the rest of token management, and writes a pat_regenerated
audit event. regenerated_at records the rotation.

tests/api/test_pat_rules.py

@@ -91,6 +91,7 @@ class TestClassification:
             ("/api/user/tokens", "POST"),
             ("/api/user/tokens", "GET"),
             ("/api/user/tokens/<string:token_id>", "DELETE"),
+            ("/api/user/tokens/<string:token_id>/regenerate", "POST"),
             ("/api/admin/users", "GET"),
             ("/api/admin/tokens/<string:token_id>", "DELETE"),
             ("/api/generate_token", "GET"),