fix(mesh): gate Trigger 2 re-bootstrap on actual api_token change (#1076)

The PUT /api/nodes/:id handler closed and re-dialed the mesh callback
bridge on every save that included api_token in the body, even when the
token was unchanged. The frontend always sends the full formData on
Save, so renames and compose_dir edits against a mesh-enabled proxy
remote produced a wasted closeBridge + ensureBridge round-trip and a
spurious manager_rejected entry in the activity log.

Gate the re-bootstrap on a real value diff against the persisted token.
Adds an existing-node lookup (returns 404 on missing id, which the
handler previously lacked) so the comparison has the pre-update value.
Reorders the guards so resource-not-found beats payload validation.

Adds one integration test for the same-token path; the existing three
trigger-2 cases continue to assert close + ensure firing on a real
rotation, no-token-in-payload, and mesh-disabled.

backend/src/__tests__/mesh-token-rotation-integration.test.ts

@@ -174,4 +174,24 @@ describe('Trigger 2: api_token rotation forces re-bootstrap', () => {
         expect(closeSpy).not.toHaveBeenCalled();
         expect(ensureSpy).not.toHaveBeenCalled();
     });
+
+    it('does not fire when api_token in payload equals the current value', async () => {
+        const closeSpy = vi.spyOn(MeshProxyTunnelDialer.getInstance(), 'closeBridge');
+        const ensureSpy = vi.spyOn(MeshProxyTunnelDialer.getInstance(), 'ensureBridge')
+            .mockResolvedValue(null);
+        const nodeId = seedProxyNode(true);
+        const existingToken = DatabaseService.getInstance().getNode(nodeId)?.api_token;
+        expect(existingToken).toBeTruthy();
+
+        const res = await request(app)
+            .put(`/api/nodes/${nodeId}`)
+            .set('Authorization', authHeader)
+            .send({ name: `renamed-${uniqueSuffix()}`, api_token: existingToken });
+
+        expect(res.status).toBe(200);
+        await new Promise((r) => setImmediate(r));
+
+        expect(closeSpy).not.toHaveBeenCalled();
+        expect(ensureSpy).not.toHaveBeenCalled();
+    });
 });