Rotate Code

Replaces the tenant's join code with a freshly generated one and returns it in the response body (the only time the new value is shown in full). The OLD code stops working immediately for anyone trying to join with it: every join link and any invite text that embeds the old code goes stale, so this is a "the help-desk is about to get join-code tickets" action, not a routine rotation. The body is optional; when present it must be application/json with only expires_at (RFC 3339, in the future), or the call is a 400 and the code is not rotated. expires_at makes the new code stop resolving at that time everywhere a code is accepted, exactly as if it had been rotated away: new joins AND sign-in by code. Existing members who name the workspace by its code (the OAuth sign-in page, or any auth route given tenant_code) cannot sign in that way until an admin rotates again; SSO, Privy app sign-in and existing sessions are unaffected. Those routes answer 404 tenant_code_expired. Omitted, the code never expires. Each rotation sets the expiry afresh, and rotating is the only way to change it.