Replace Secret

Replace the caller's ACTIVE secret with this alias by a new sealed value and context (step 5): retire the old one (its stored value overwritten, its row kept as history), then store the new one under the SAME alias. 404 when there is nothing to replace — a new name is created with POST /vault/secrets, never by PUT. The body is validated BEFORE anything is retired. The two steps are not one transaction (simplest first, 2026-10-10): if the store fails after the retire, the error says so, the alias is free, and the caller stores again with POST; the agent sees "no such alias" in between, never a stale value. The quota count leaves retired secrets out, so a replace never needs headroom.