fix(bcos): reject duplicate cert_id instead of silently overwriting + erasing anchor

[Vyacheslav-Tomashevskiy]

What

bcos_attest() (node/bcos_routes.py) stored the certificate with INSERT OR REPLACE, but cert_id is UNIQUE (schema line 184) and the handler carries an except sqlite3.IntegrityError -> 409 "Certificate ... already exists" guard.

INSERT OR REPLACE resolves a UNIQUE conflict with a silent DELETE + INSERT, so it never raises IntegrityError. The 409 guard was therefore dead code, and a second attest for a known cert_id silently overwrote repo / tier / trust_score / reviewer / report.

The REPLACE column list also omits anchor_tx and passes anchored_epoch=None, so re-attesting a ledger-anchored certificate wiped its anchor_tx back to NULL. That breaks the documented idempotency of /api/v1/bcos/anchor (an already-anchored cert should return its existing tx hash, not write a second ledger row): after the wipe, a re-anchor writes a second ledger row with a fresh tx hash for the same certificate.

Auth passes on is_admin OR valid Ed25519 signature over a caller-supplied signer_pubkey, so any party can self-sign a report they authored and overwrite a known public cert_id.

Repro (deterministic)

1. attest BCOS-x (repo Scottcjn/Rustchain, L2, trust 90) -> anchor it (anchor_tx set).
2. re-attest the same cert_id with repo attacker/evil, trust 100.
3. Before fix: no IntegrityError; row becomes {repo: attacker/evil, trust_score: 100, anchored_epoch: None, anchor_tx: None} -- anchor erased, trust forged, 409 never fires.

Fix

Plain INSERT (one word). The duplicate now raises IntegrityError, the existing 409 guard fires, and the original record + its anchor are preserved. cert_id is meant to be immutable once issued -- exactly what the "already exists" 409 already intended.

Same overwrite class the repo already treats as a real bug in node/tests/test_attestation_overwrite_reward_loss.py (that one is miner_attest_recent; this is the untouched bcos_attestations table).

Tests

• Adds node/tests/test_bcos_reattest_preserves_anchor.py -- fails on old code, passes on the fix (mutation-checked).
• Existing node/tests/test_bcos_routes.py (8 tests) still green.

RTC reward address: RTCd1554f0f35576faf01d386a6be1c947f560dd0b7