Rotate key (new secret displayed only once)

Permitted for active, unexpired keys only. Creates a new key (inheriting label, limits, cu_cap, expires_at, and settled cu_spent; quota not reset by rotation) and revokes old key; the old key is refused by the gateways normally within about 1 second, and at most 5 seconds if a change notification is lost; replaced in response is revoked old key whose replaced_by_key_id matches new key key_id.

The original key must first be enabled, unrevoked and unexpired, otherwise 409 key_not_active. Rotation does not add to the live-key count but remains subject to the rolling 24-hour creation cap (429 rate_limited, error.reason daily_creations, Retry-After: 3600). It preserves the original limits, expiry and settled spending rather than resetting them.