feat(user): Personal access tokens can be regenerated (#38907)

Lets users regenerate a personal access token's value in place, keeping
its name and scopes, instead of deleting and recreating it. Useful when
a token was shared with a third party (e.g. an AI agent) and needs to
be invalidated immediately without redoing scope selection.

Follows the same pattern already used for OAuth2 application client
secrets (`GenerateClientSecret`/`RegenerateSecret`).

**Testing**: added a model unit test and a web integration test;
manually
verified in the running dev server that the old token stops
authenticating
and the new one works immediately after regenerating.

<img width="1040" height="245" alt="image"
src="https://github.com/user-attachments/assets/4de0d8b4-1fc4-49cf-a859-95e24d0b2c0a"
/>

Fixes #38683.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

tests/integration/user_settings_test.go

@@ -8,6 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
@@ -283,6 +285,25 @@ func TestUserSettingsApplications(t *testing.T) {
 		assertNavbar(t, doc)
 	})
 
+	t.Run("RegenerateAccessToken", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		session := loginUser(t, "user2")
+
+		before := unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{ID: 3, UID: 2})
+
+		req := NewRequestWithValues(t, "POST", "/user/settings/applications/regenerate", map[string]string{
+			"id": "3",
+		})
+		session.MakeRequest(t, req, http.StatusOK)
+
+		after := unittest.AssertExistsAndLoadBean(t, &auth_model.AccessToken{ID: 3, UID: 2})
+		assert.Equal(t, before.Name, after.Name)
+		assert.Equal(t, before.Scope, after.Scope)
+		assert.NotEqual(t, before.TokenHash, after.TokenHash)
+		assert.NotEqual(t, before.TokenSalt, after.TokenSalt)
+	})
+
 	t.Run("OAuth2", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()