Rotate API key (mint new + schedule old revocation after grace window)

Mints a brand-new key with the same name, scopes, and environment as the existing one. The old key keeps verifying for `grace_hours` (default from the `art.key.rotation_grace_hours` setting, clamp 0–168) so the customer can roll the new key into their integration without downtime. Returns the new plaintext exactly once.