Rotate the webhook signing secret

Generates a new signing secret and places the previous secret into a grace/overlap window. The response contains exactly two active secrets: the new primary (expiryAt null) and the previous primary (expiryAt set to now + overlapHours). If an overlap secret is already active (a previous rotation is still within its grace window), rotation is blocked and a 409 Conflict is returned. The caller must first explicitly revoke the overlap secret via DELETE /webhook-secret/{id}, or wait for the grace window to expire, before rotating again. This ensures the active secret count never exceeds two and makes the invariant explicit rather than silently evicting secrets.