Regenerate CI webhook secret

Generates a new CI webhook secret for the check and invalidates the old one. The new secret is returned write-once — copy it immediately; it cannot be retrieved again. If the check has no ci_provider set, returns 400.

This breaks whatever is already configured. The old secret stops verifying the moment this returns, so every CI job still signing with it fails its signature check until the new value is pasted in. To read the secret a monitor already has without rotating it, use the LastPing console, which can show an existing secret without rotating it.

Requires admin scope when called with an API key, the same tier as the /api/v1/api-keys routes: this rotates a live credential, and the write-scoped key most likely to call it is the one sitting in the very pipeline it would break. A key of a lower tier is refused 403 INSUFFICIENT_SCOPE with required_scope: admin. No password is asked of a key.

Requires the account password when called with a browser session (the console): send {"password": "..."}. A session is not scope-tiered (the session is the account owner), so the re-check is what establishes that the person at the keyboard is the account holder rather than whoever borrowed the tab. A wrong password and an account with no password at all (signed up through Google or GitHub) both answer 403 INVALID_PASSWORD, with the same body and the same latency, so the response never says which accounts have passwords.

Throttled on the signed-in user's own id, with the budget sign-in allows one account: 10 attempts per 15 minutes, shared with the console's own reveal action. Ten failed reveals therefore leave a regenerate attempt refused 429 TOO_MANY_ATTEMPTS too: the thing being limited is password attempts by this session, and two budgets of ten would be one oracle of twenty. Over the limit the request is refused BEFORE the password is read or compared, and a successful attempt does not reset the window.

CSRF-gated for cookie callers: the lp_csrf cookie value must be echoed in the X-CSRF-Token header, or the answer is 403 CSRF_REQUIRED. The response is never cached (Cache-Control: no-store).

To create a CI binding, supply ci_provider (and optionally ci_workflow, ci_branch) when calling POST /api/v1/checks.