One admin command re-seals every sealed value under the newest key, and says how many it moved #11473

Intent: with key ids on sealed values, an operator needs one deliberate action to finish a rotation.

Done:

• [ ] bun scripts/rotate-secret-key.ts reads FORGE_DATA, makes a new secret.key (old kept as secret.key.old), re-seals every sealed column (origin tokens, secrets, notes) in one transaction, and prints counts per table.
• [ ] Dry run by default; --apply writes; a second run moves nothing.
• [ ] A test seals rows under key A, rotates, and opens them all under key B with A deleted.

Files: scripts/rotate-secret-key.ts, test/rotate-secret-key.test.ts, docs/RECOVERY.md Risks: a half-finished re-seal must roll back whole; never print a plaintext Brief: a Trust builder. A person assigns. Every behaviour added has a test that fails without it; bun test passes; touching src/web runs bun scripts/design-lint.ts.