#694 serve-auth: swamp access token rotate command

Parent

Related to #662 (serve authentication & authorization).

Problem

When a server token is leaked, the admin must manually revoke the old token and mint a new one with a different name:

```bash swamp access token revoke sarah-token swamp access token mint sarah-token-2 --principal user:sarah ```

The old token name can't be reused because the revoked instance still exists. The admin has to choose a new name, and the user has to update their stored credential.

Solution

Add a `swamp access token rotate ` command that atomically:

1. Revokes the existing token
2. Mints a new token with the same name (or a derived name like `-v2`) for the same principal
3. Outputs the new plaintext once

```bash swamp access token rotate sarah-token → Token rotated. New token: sarah-token.newSecret123... Previous token has been revoked. Give the new token to the user. ```

The principal is read from the existing token record — the admin doesn't need to re-specify it.

Considerations

• The ServerToken model's `create` method throws if an instance already exists (even if revoked). The rotate command may need to either: create a new instance with a derived name, or modify the model to support re-creation after revocation.
• The user must update their stored credential with `swamp auth server-login` after rotation.
• This is a local-only command (same as `token mint`) — requires vault access.

Priority

Low — revoke + re-mint works for now. This is a UX improvement for the token compromise workflow.