API keys

Rotate issues a new secret and keeps the old one valid for 24 hours. Revoke disables a key immediately but keeps the record. Delete removes it permanently — conversion and audit history is kept but unlinked. Each action asks for confirmation first.