Rotate the calling application's EC keypair

Generates a fresh EC P-256 keypair for the authenticated application and returns the new public key (JWK) and private key material (appPrivateJwk).

The private JWK is returned only once - store it securely. After rotation:

• IDaaS will encrypt all outbound webhooks with the new public key.
• Requests encrypted with the old public key will be rejected (Content-Encryption: JWE decryption will fail).
• Allow a brief migration window for in-flight messages before destroying the old private key.

The keyVersion field is incremented on each rotation.