fix(security): idempotent /api/configure-pat (defence-in-depth follow-up to #42)

[dgokeeffe]

Summary

Defence-in-depth follow-up to the configure-pat hotfix in #42. Refuses re-configuration of the PAT once the rotator is alive with a valid token, returning 409 Conflict.

Why this exists

PR #42 closed the impersonation vector — a non-owner can no longer call `/api/configure-pat` and persistently impersonate the owner.

But the endpoint is still non-idempotent for the legitimate owner. Once a PAT is configured, anything that can drive the owner's authenticated browser session can swap PATs out from under the rotator:

• An XSS vector in the CoDA frontend (CSP is strict but `'unsafe-inline'` for scripts widens it)
• A malicious tab the owner has in another browser window
• Browser malware or a compromised extension
• An accidental double-submit during a network blip

The owner-gate from #42 cannot distinguish "the owner sent this" from "something running in the owner's browser sent this." This PR adds a state-based check that closes the swap vector regardless of who appears to be calling.

The guard

if pat_rotator.token and not pat_rotator.is_token_expired:
    logger.warning(...)
    return jsonify({"error": "PAT already configured. Restart the app to reconfigure."}), 409

Scenario	Behaviour
Fresh app, no PAT yet	`token` is None → passes → normal bootstrap → 200
PAT set but expired (rotator timed out while idle)	`is_token_expired = True` → passes → owner can re-bootstrap
PAT actively configured + rotator alive	→ 409 Conflict, log entry written
Frontend during normal use	Never calls configure-pat post-success (verified by grep) — no regression

Why 409, not 403

403 says "you're not allowed." 409 says "the resource is in a state that conflicts with this request." The owner DOES have permission — the issue is that bootstrap is single-shot. 409 is the semantically correct response.

Tests

• `test_configure_pat_rejected_when_already_configured`: rotator alive → even owner gets 409
• `test_configure_pat_allowed_when_token_expired`: rotator timed out → owner can still bootstrap
• All 6 `TestConfigurePatAuth` cases pass; 233/233 unit tests pass

What this PR is NOT

• Not a primary security control — fix(security): owner-gate /api/configure-pat (hotfix) #42 remains the primary. This is defence-in-depth.
• Not a behavioural change for the frontend — `createPane()` only calls configure-pat in the "PAT not valid" branch, which by definition means `is_token_expired` is true, which the new guard explicitly permits.

Test plan

• 233/233 unit tests pass
• Behavioural matrix above verified via unit tests
• Sathish post-hoc review

This pull request and its description were written by Isaac.