Rotate Master Key

Regenerate the database-backed master key and invalidate the old one.

Only the first-run generated master key can be rotated here. When a master key is supplied through config or OTARI_MASTER_KEY, the dashboard cannot invalidate it; the operator must change that value and restart instead.

Every dashboard session is revoked with the rotation (a session only proves possession of the now-dead key); the caller's own session is re-minted under the new key so the tab that performed the rotation stays signed in.