Rotate a monitor webhook signing secret

Replaces the signing secret for an owned monitor that has notifyWebhookUrl configured. The response is the only disclosure of the replacement: monitor reads and lists never include it. Store it on receipt.

Every accepted call creates a new secret; this operation is not idempotent. Deliveries already queued retain the secret snapshotted when they were accepted, so a receiver should accept both the previous and replacement secrets until those attempts drain.

A missing, foreign, or notification-less monitor answers the same 404 MONITOR_NOT_FOUND. Never billed and never launches a browser.