Never revoke the configured bootstrap API token

[timmarkhuff]

Summary

• Reverts #466 (enable_token_rotation). That flag was added so Edge Endpoint's inbound request path would not mint/revoke against caller-owned tokens. The cross-revocation concern was driven by parking the configured token as previous and deleting it on the next refresh.
• Changes TokenManager so the configured bootstrap token is never written into the cache slot and never revoked. On first mint the slot is { current: <new child>, previous: null }. Later refreshes only revoke manager-minted working tokens in the usual two-token cycle.
• Result: multiple processes that share the same configured token (app + Edge inbound clients, or several Edge device containers) each maintain independent child chains without destroying the bootstrap credential. The bootstrap token remains usable until it expires on its own.

Why this replaces enable_token_rotation=False

With the old "park bootstrap as previous" policy, enabling rotation on a forwarded caller token could revoke that caller's seed. #466 avoided that by skipping TokenManager entirely for Edge inbound clients.

Under this policy, rotation can stay on: Edge and the app may both mint children from the same seed, but neither revokes the seed or the other's children. That removes the main reason for the disable flag.

Follow-ups

• Edge Endpoint #469 currently passes enable_token_rotation=False for inbound clients. After this lands (and is released), that call-site flag should be removed; inbound clients can rotate safely under the new bootstrap policy. Device-token sharing via GROUNDLIGHT_TOKEN_DIR remains useful so containers share one working-token cache rather than minting parallel chains.
• This removes a public constructor kwarg shipped in 0.31.0. Cut a follow-up release (0.31.1 or 0.32.0) accordingly.

Test plan

• poetry run pytest test/unit/test_token_manager.py test/unit/test_token_refresh_client.py (20 passed)
• Confirm first mint writes previous: null and first refresh does not call delete on the bootstrap token name
• Confirm subsequent refreshes still revoke the demoted working token
• Edge follow-up: drop enable_token_rotation=False after consuming this release