Rotate a personal API key

Atomically mints a replacement key with the same name and scopes as the original, then immediately revokes the old key. The full new secret is returned in the response — this is your only chance to capture it. Old key is invalid as soon as the response is returned; if you need overlap with an in-flight deploy, create a second key first via POST /api-keys, ship your code, then DELETE the old key. Rotation is for the suspect/compromised-key case where overlap is the opposite of what you want. Authorization: key_id is matched together with the authenticated caller's user id, so a key owned by another user is invisible (404) and no one else's personal key can be rotated.