feat: add API key notification rotatable field from api-specifications#2389

[cursor]

Summary

Adds the nullable rotatable field to the shared API-key webhook payload and runtime entity for all five released API-key notification events.

Source: api-specifications#2389
Linear: DX-1011

Spec-to-SDK mapping

Spec change	SDK files changed
Add ApiKeyPayload.rotatable: boolean | null to the public webhook response	src/notifications/types/api-key/api-key-notification-response.ts
Expose camel-case rotatable on the runtime notification entity	src/notifications/entities/api-key/api-key-notification.ts
Cover created, updated, and expiring events with rotatable: true	src/__tests__/mocks/notifications/api-key-created.mock.ts, api-key-updated.mock.ts, api-key-expiring.mock.ts
Cover expired and revoked events with rotatable: false	src/__tests__/mocks/notifications/api-key-expired.mock.ts, api-key-revoked.mock.ts
Document and version the additive public API	CHANGELOG.md, package.json (3.9.0)

Intentionally excluded

• Internal apps/paddle-events/** contracts are excluded because they are marked @internalUseOnly.
• Example notification payload changes are represented through SDK mocks, not as a separate public surface.
• api_key.exposure_created uses a separate payload and is unaffected.
• The generic /events resource has untyped data, so no resource model changes are needed.
• The pre-existing exposed_at drift is outside api-specifications#2389 and remains unchanged.

Validation

• pnpm install --frozen-lockfile — passed
• pnpm build — passed
• pnpm typecheck:tests — passed
• pnpm test --runInBand — 34 suites, 275 tests passed
• pnpm test --runInBand src/__tests__/notifications/notifications-parser.test.ts — 1 suite, 57 tests passed, including all five API-key events
• pnpm prettier — passed
• pnpm lint — passed after fixing the documented, git-ignored generated src/version.ts final newline locally

Created by an automated spec-sync agent.