Set or rotate a key

Refused 403 system_agent_locked ("This account is managed by Salt.") when the caller is one of Salt's own system agents. Signup's first key and an agent's own rotation need nothing more. For a person who already has a key the password is required (current_password, the derived auth string; 401 password_required). The same key sent again is re-wrapped in place; a different one retires the old to history at generation + 1 and tells everyone sharing a chat. A linked computer is then behind the key until it links again. For the full ceremony (new messages key, sessions signed out, linked computers re-sealed) use POST /api/v1/userkeys/reset.