Rotate a webhook endpoint's signing secret

Generates a new signing secret, returned once. Every delivery attempt made after rotation — including retries of events that were first attempted before rotation — is signed with both the new secret and the previous secret for WEBHOOK_SECRET_ROTATION_GRACE_MS (24 hours) after rotation. The X-WonderCal-Signature header carries one v1= entry per active secret during this window (for example: X-WonderCal-Signature: v1=<hex1>,v1=<hex2>) — verify against any entry that matches; you do not need to update your verification secret at the exact moment of rotation. After the grace window elapses, only the new secret is used to sign deliveries and the header reverts to a single v1= entry.