Support zero-downtime token rotation with a secret grace window

[ikhoon]

#1340 adds staged token secret rotation: deactivate → regenerate → distribute → activate.
This is safe, but the token cannot authenticate between deactivation and activation, so a
rotation always involves downtime for the clients of the token.

It would be nice to allow a token to have two valid secrets for a limited time, similar to
how cloud providers rotate access keys:

1. Issue a new secret while the current one stays valid.
2. Distribute the new secret to the clients.
3. Revoke the previous secret once every client has switched — explicitly, or automatically
   after a configurable grace period.

This would make routine secret rotation possible with zero downtime.

Considerations:

• The registry schema needs to hold more than one secret per token, e.g. a previousSecret
  with an expiration.
• The authorizer must resolve both secrets while the grace window is open.
• The web UI should indicate that a rotation is in progress.