Get Rotations

Serve the captured, self-certifying rotation proofs read-only (Ticket #10a) so a consumer (geiant) can INDEPENDENTLY verify anchor→current instead of trusting grafomem's re-issue. Each proof is served raw (byte-parity with what prev_key signed); the reader re-checks every signature — the server is untrusted transport, never an authority on continuity.

Optional ?anchor=<hex> / ?current=<hex> filter to one identity's chain, resolved server-side via resolve_identities (a convenience; the reader still re-verifies). Read-only, no write path touched.

Auth: tenant-scoped (parity with the reviews/substrate reads) — a valid tenant context is required. Because the proofs are self-certifying, this route COULD be made anonymous by adding "/v1/cgr/rotations" to auth.py's _SKIP_AUTH_PATHS (as /v1/cgr/issuer is); left tenant-scoped by default until a concrete anonymous-verifier need lands.