Reauthorize Account

Stage a replacement agent key and return the EIP-712 payload to sign.

C9 (incident 2026-08-03 follow-up 1): this endpoint used to ROTATE the active signing key (disabling the live KMS signer) and drop the account to 'pending_authorization' BEFORE any wallet signature existed — abandoning the wallet prompt stranded a previously healthy account on a dead signer.

Now nothing about the live identity changes here. A replacement key is minted in 'pending' status ALONGSIDE the active one (it cannot sign), its identity + fresh nonces are staged under meta.pending_reauth, and the swap (venue approval → key activation → account row update) happens atomically in /authorize only AFTER the new approveAgent signature succeeds. An abandoned or failed reauth leaves the account fully functional on its previous agent; re-entering the flow reuses the staged pending key with fresh nonces.

The body runs inside the account-flow boundary (Q-2614, services/account_flow_events.py, flow reauthorize): every refusal is recorded once, there.