Rotate webhook signing secret

Generates a new signing secret for the endpoint. The previous secret remains valid until previousSecretExpiresInSec elapses (default 24h, max 30 days). During the grace window deliveries are signed with both secrets so receivers can migrate without downtime. Returns the new secret — this is the only time it is shown in plaintext.