Add rotate-secret endpoint for routes-b webhooks

[chigozirim007]

Context

Webhook secrets are forever today. If a secret leaks, the user has no way to rotate without deleting and recreating the webhook (losing its history). We need an explicit rotate action.

Tasks

• Add POST /webhooks/[id]/rotate-secret that generates a new secret and returns it once
• Keep the previous secret valid for a 24-hour overlap window (signing helper accepts both during overlap)
• Audit-log every rotation
• Rate-limit to 5 rotations per webhook per day
• Tests: rotate returns plaintext once, list endpoint shows new fingerprint, old signature still valid within window, old signature invalid after window, rate-limit enforced

Acceptance criteria

• Zero-downtime rotation (overlap window)
• Plaintext leaves the system exactly once

Out of scope

• Auto-rotation on schedule
• Webhook receiver-side guidance docs

Scope (important — read carefully)

All work for this issue MUST live inside app/api/routes-b/.

• No edits to files outside this folder
• Any shared helpers (validation, types, utils, caches, rate limiters) must be created inside app/api/routes-b/_lib/ (create the folder if missing)
• Do NOT add new helpers to the top-level lib/ directory or any other top-level location
• Tests must live inside app/api/routes-b//tests/
• Existing imports from @/lib/... (prisma client, auth) may be reused as-is — only new code must stay inside routes-b