Rotate database credentials

Resets the database role password through the provider and returns the new connection URI; the previous URI stops authenticating immediately. Rotation drops any live connections or pools still using the old credentials — plan to reconnect. Rotation is idempotent: if a rotation reports a persistence failure, rotating again issues a fresh working connection string.