Create, rotate or revoke the firm's Google Ads feed credentials

Firm owner/admin only. Create refuses if a connection exists; rotate requires an existing connection. Rotation/revocation invalidates old credentials. Create/rotate return status plus credentials {username,password}, with the password shown only once. Store and transfer it privately. Does not write to Google or change campaign settings. The external feed is GET /api/client-onboarding/google-ads/purchases.csv, authenticated only by these HTTP Basic credentials, never a LedgerHQ account password. Returns CSV on success, 401 on invalid/revoked credentials, 429 on rate limit or 503 on temporary failure; no caching. The feed contains conversion_name, conversion_time (UTC ISO 8601), conversion_value (USD dollars), conversion_currency, order_id, gclid, gbraid, wbraid. Map these columns in Google Ads Data Manager and schedule daily imports.