Begin a subscriber-HMAC rotation (current → previous)

Generates a new current secret and moves the existing one into the previous slot. During the overlap BOTH secrets verify live `<Inbox />` sessions (auth checks current then previous), so rotation is zero-downtime. Complete the rotation to clear the previous slot once every customer backend has switched.

curl -X POST "https://example.com/admin/api/environments/string/hmac/rotate"

{
  "has_previous_secret": true,
  "subscriber_hmac_rotated_at": "string",
  "subscriber_hmac_secret": "string"
}

{
  "error": {
    "code": "invalid_request",
    "message": "string"
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "string"
  }
}