feat: add idempotent token deletion before generating new Gitea backup admin token

phase2_gitea_fedora.sh

@@ -132,6 +132,12 @@ if [[ -n "${GITEA_BACKUP_ADMIN_TOKEN:-}" ]]; then
 fi
 
 if [[ -z "${GITEA_BACKUP_ADMIN_TOKEN:-}" ]]; then
+  # Delete any stale token with the same name (idempotent re-run safety).
+  curl -sf -u "${GITEA_ADMIN_USER}:${GITEA_ADMIN_PASSWORD}" \
+    -X DELETE \
+    "${GITEA_BACKUP_INTERNAL_URL}/api/v1/users/${GITEA_ADMIN_USER}/tokens/migration-token" \
+    -o /dev/null 2>/dev/null || true
+
   # Generate via basic auth — token is only returned once in the .sha1 field
   TOKEN_RESPONSE=$(curl -sf -u "${GITEA_ADMIN_USER}:${GITEA_ADMIN_PASSWORD}" \
     -X POST \