Rotate the signing secret

Deliberately separate from repointing the URL. Rotation breaks every receiver that has not been updated, so it must be an explicit act rather than a side effect of editing a field. There is no overlap window: the new secret applies to the next delivery.