A new client secret, shown once. The old one keeps working for `overlapHours` (24 by default, 0 ends it now, up to 168).

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. At most two secrets work at once. A service account on private_key_jwt moves to its client secret. Behind the machineIdentities sub-flag: 404 not_found while it is off. A service account gets tokens from https://auth.50heads.com/token with grant_type=client_credentials and its client id and secret (HTTP Basic or the body) or a private_key_jwt assertion; no refresh token, ask again when it expires.