Rotates a tunnel token: revokes the PRESENTED token and issues a replacement with the same identity (email/license/machine), settings, approval and last-seen time. The token is the credential (same trust model as /tunnel/data-enable): only its holder can rotate it, and it rotates only itself. Old token stops working immediately; the local server must be given the new token (config.json cloud_token) and restarted.

lmcp-api#262: this used to revoke EVERY live token of the presented token's machine. A machine id is not a secret and register-anon mints a token for any machine id without authentication, so anyone could cut a machine off (its approved token, its web-AI connectors) and receive a fresh token of that machine, which a grandfathered key (routing_bound false) then routed on. A token proves nothing about its siblings, so it cannot revoke them. The response shape is unchanged: the caller sends {token} and reads token (the Mac tray, MenuBarView.rotateCloudToken; any client may call it under contracts/relay-token-rotate.v1.json).