Rotate an MCP staff key (new value shown once)

Generates a new key value, replaces key_hash and key_prefix, and returns the plaintext once. The old value stops working immediately. Active state, grants and expiry are unchanged. Allowed for a platform owner, or for the platform admin who created the key when the key is neither global nor holds any write grant. A concurrent rotation answers 409.