Rotate DataHub token-service secrets

Generates fresh values for DATAHUB_TOKEN_SERVICE_SIGNING_KEY (the key GMS uses to sign API access tokens) and DATAHUB_TOKEN_SERVICE_SALT (the salt behind the token revocation-check hash), updates every DataHub app child that carries them, and triggers a coordinated restart so the new values take effect everywhere simultaneously. USER-VISIBLE SIDE EFFECT: every previously issued API access token (personal access tokens, service tokens) is permanently invalidated. The tokens are stateless JWTs, so the old key and salt cannot be recovered and matching tokens cannot be reissued. Users and automations must create new API tokens through the UI or GraphQL API. Browser sessions (cookie-based) are unaffected.