Rotate Block Polaris Credentials

Rotate the caller's Polaris client credentials.

Mints a fresh client_id/secret for the client's existing Polaris principal, persists it (the secret lands in the encrypted column), and returns the new pair. The previous credentials are invalidated server-side, so this is the caller's only chance to capture the new secret. Exposed to the carbonarc SDK as client.block.rotate_polaris_credentials.

Gated like the "Connect Your Query Engine" credential read (Enterprise + any Block role). The rotation is stamped on the client row (attributed to the caller) so it surfaces in the CAMS Client Management Block section.