Upload HITL keypair

Upload the client-generated RSA keypair for a HITL config. ?force=true acknowledges the key-rotation cascade, which invalidates envelopes wrapped to the previous key. A ROTATION (a new kid on an active config) from a JWT dashboard session requires a live hitl_key_rotate 2FA step-up grant (403 2fa_required — start one via POST /me/2fa/start with action_type: hitl_key_rotate); an API-key caller is not step-up gated. Every successful rotation, from either path, emails the account owner at their primary email address (when one is on file). A same-kid update (re-wrapping the private key) and the first upload on a config without a keypair need no grant and send no email.