Rotate the issuer signing key

Rotate the tenant's issuer signing key: mint a fresh active key for all future issuance and demote the previously active key to rotated with an overlapping-validity window (365 days) so credentials already issued under it keep verifying. Call it on a routine key-rotation schedule or in response to a suspected key compromise. Authenticated with the tenant API key.