Rotate Master Key

Regenerate the database-backed master key and invalidate the old one.

Only the first-run generated master key can be rotated here. When a master key is supplied through config or OTARI_MASTER_KEY, the dashboard cannot invalidate it; the operator must change that value and restart instead.

Every dashboard session is revoked with the rotation (a session only proves possession of the now-dead key); the caller's own session is re-minted under the new key, for the same identity it named, so the tab that performed the rotation stays signed in as who it was. A caller that authenticated with a header key has no session identity to re-mint for, so it is not handed one: it was not signed in to the dashboard to begin with.