Why two mechanisms and not just one?
They serve different purposes. The settings API offers read/write access from the application, whereas config is read only (unless you write the file in code).
Settings can be defined per user or per application, and are designed to be volatile. User settings are written to hidden folder within User Profile storage which is permitted under UAC.
App.config is per application only. Changes to App.config aren't automatically picked up. It requires restart or code to refresh the values. Under UAC users are not permitted to write to the application directories such as Program Files, so this file should be considered static readonly.
What are the most common scenarios for using app.config over
Settings.settings, and vice versa?
You could use Settings in a desktop application for storing user preferences, or settings that change at runtime.
You would use App.config for more generic static settings, like connection strings etc, or for defining the configuration of components used within your app.
What happens if my app is using Settings.settings and I change a
value in app.config after it's been deployed?
If the application is redeployed then it will pick up the new settings, unless there are user/app customisations on the machine already in which case it will continue to use those, unless you wipe them.
If you add new settings, these will get picked up. In fact the default values are baked into the Settings class, so even if the app.config is empty the Settings still function.