feat(credentials): re-key team vaults, and reach sh1pt's vault as a provider (#117)

Two additions to Credential Sharing.

`logicsrc credentials rotate` (alias `logicsrc secrets rotate`) re-keys a
team vault: fresh DEK, re-sealed to the members who keep access, every
secret re-encrypted under it. Values do not change, so nothing that
consumes them breaks; what changes is that every wrapped key issued
before the rotation is dead. --active (the default) keeps only active
members and revokes the rest -- the "someone left" rotation. --all keeps
everyone who holds access, for plain hygiene. Dry run by default, like
`sync`.

The DEK is recoverable ONLY through the grants, so a half-applied
rotation makes a vault permanently unreadable by everyone. The whole next
state therefore goes to the server in one request and commits in one
transaction (new db.batch helper). The server also requires every
submitted fingerprint to equal the stored one: it cannot see values, but
it can prove a re-key did not swap any. Rotations that would leave the
caller ungranted, grant nobody, or cover the wrong secret count are
rejected before anything is written. GET /vaults/:id/grants now returns
publicKey and status so a client can re-seal in one pass instead of N+1
user lookups, and revocation finally deletes the grant row rather than
leaving one that reports access it no longer confers.

The sh1pt adapter is the fifth provider. It is the only one driven
through a CLI rather than HTTP, because sh1pt publishes
`sh1pt secret set|get|list|rm` as the interface to its vault and
documents no REST endpoint. Values go over the child's stdin, never argv
-- a secret in argv is readable by any user on the host via ps. Since
`sh1pt secret get` needs interactive confirmation it cannot be scripted,
so the adapter is write-only for values like github-secrets: a sync
target, never a source, no value-restoring rollback.

Tests drive a real fake sh1pt binary rather than a mocked execFile, which
is how the hang surfaced: with nothing to pipe, stdin was left open and
any subcommand that reads it would wait forever. It is now always closed.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/credential-sharing.md

@@ -55,12 +55,30 @@ env
 doppler
 railway
 github-secrets
+sh1pt
 ```
 
 - `.env`: read, diff, redact, and write local environment files.
 - Doppler: sync project/config scoped secrets.
 - Railway: sync service variables.
 - GitHub Secrets: sync repository, organization, and environment secrets.
+- sh1pt: sync the distribution credential vault — App Store Connect keys, Play
+  service accounts, npm and Docker tokens, Cloudflare tokens.
+
+`sh1pt` is the one adapter driven through a **CLI** rather than an HTTP API,
+because sh1pt publishes `sh1pt secret set|get|list|rm` as the interface to its
+vault and documents no REST endpoint for it. That is a transport choice inside
+an adapter, which is the layer where product-specific I/O belongs; it does not
+move product-specific commands into the core contract. Two consequences worth
+stating:
+
+- Values are written on the child process's **stdin**, never as argv. A secret
+  passed as a command-line argument is readable by any user on the host via
+  `ps` for the lifetime of the call.
+- `sh1pt secret get` requires interactive confirmation and so cannot be
+  scripted. The adapter is therefore write-only for values (`readValues:
+  false`), exactly like `github-secrets`: it can be a sync target but never a
+  source, and it supports no value-restoring rollback.
 
 ## Core Objects
 
@@ -96,11 +114,14 @@ plan
 diff
 approve
 sync
+rotate
 rollback
 audit
 export
 ```
 
+`logicsrc secrets …` is an accepted alias for `logicsrc credentials …`.
+
 Examples:
 
 ```bash
@@ -202,6 +223,45 @@ logicsrc teams members acme
 logicsrc teams vaults acme
 ```
 
+### Rotating a vault key
+
+```bash
+# Dry run (the default): show what a rotation would re-key and revoke.
+logicsrc credentials rotate acme web prod
+
+# Apply it.
+logicsrc credentials rotate acme web prod --approve
+
+# Every vault in the team that you can open.
+logicsrc secrets rotate acme --approve
+```
+
+Rotation replaces the vault DEK, re-seals it to the members who keep access, and
+re-encrypts every secret under it. **Secret values do not change** — nothing that
+consumes them breaks. What changes is that every wrapped key issued before the
+rotation is dead, so a copy of an old grant buys nothing.
+
+Who keeps access:
+
+- **`--active`** (default): only members whose team status is `active` *and* who
+  hold a grant today. This is the "someone left the team" rotation — everyone
+  else is revoked.
+- **`--all`**: everyone holding a grant today, whatever their status. Pure
+  crypto hygiene, no revocation.
+
+A member who holds access but has never uploaded a public key cannot be re-sealed
+to; they are reported under `skipped` and revoked rather than dropped silently.
+
+Safety properties, all enforced rather than documented:
+
+- The whole next state is applied in **one transaction**. The DEK is recoverable
+  only through the grants, so a half-applied rotation — new grants over old
+  ciphertext, or the reverse — would make the vault permanently unreadable.
+- The server requires every submitted fingerprint to equal the stored one. It
+  cannot see values, but it can prove a rotation did not swap any.
+- A rotation that would leave the caller ungranted, grant nobody, or cover the
+  wrong number of secrets is rejected before anything is written.
+
 `logicsrc login` picks its flow from the machine it runs on:
 
 - **Has its own browser** → loopback OAuth-PKCE: a `127.0.0.1` listener catches