Rotate credentials and webhook signing secrets

Rotate a compromised or retired key through the supported key-management flow. Tokens issued with an origin-key binding are refused after that key is revoked or rotated; legacy tokens issued before this change may last until expiry.

• POST /api/webhooks/{webhookId}/rotate-secret returns a replacement signing secret once. Update your receiver because subsequent deliveries use it.
• API-key and token reads of webhook records mask signing secrets.
• DELETE /api/me/key revokes the current API key; broader key administration requires an authorized person's access.

Verify webhook signatures over the raw body and use event IDs to reject duplicate deliveries. The timestamp header is not covered by the body signature.