feat(auth): add sf provar auth rotate command

Implements /auth/rotate endpoint: atomically replaces the stored pv_k_ key
with a new one without going through the browser login flow. Old key is
invalidated immediately on success.

- src/commands/provar/auth/rotate.ts — new SfProvarAuthRotate command
- messages/sf.provar.auth.rotate.md — summary, description, examples
- src/services/qualityHub/client.ts — rotateKey() function + indirection entry
- test/unit/commands/provar/auth/rotate.test.ts — 5 unit tests (599 total)
- README.md, docs/mcp.md — rotate command documentation

Root cause of test ERROR: null debugged and fixed — ts-node/esm surfaces
noUnusedLocals TS6133 as a null-prototype error when a module-level sinon
stub variable is declared but never read (sinon.restore() cleans up without
referencing it). Fixed by inlining stubs inside each it() block.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: mrdailey99

README.md

@@ -60,6 +60,7 @@ When `NODE_ENV=test` the validation step is skipped entirely. This is intended o
 # Commands
 
 - [`sf provar auth login`](#sf-provar-auth-login)
+- [`sf provar auth rotate`](#sf-provar-auth-rotate)
 - [`sf provar auth status`](#sf-provar-auth-status)
 - [`sf provar auth clear`](#sf-provar-auth-clear)
 - [`sf provar mcp start`](#sf-provar-mcp-start)
@@ -120,6 +121,28 @@ EXAMPLES
     $ sf provar auth login --url https://dev.api.example.com
 ```
 
+## `sf provar auth rotate`
+
+Rotate your stored API key without re-authenticating via browser.
+
+```
+USAGE
+  $ sf provar auth rotate
+
+DESCRIPTION
+  Exchanges your current pv_k_ key for a new one atomically. The old key is
+  invalidated immediately. The new key is written to ~/.provar/credentials.json.
+
+  Use this to rotate your key on a regular schedule (~every 90 days) without
+  going through the browser login flow. If your current key is already expired,
+  run sf provar auth login instead.
+
+EXAMPLES
+  Rotate the stored API key:
+
+    $ sf provar auth rotate
+```
+
 ## `sf provar auth status`
 
 Show the current API key configuration and validate it against Quality Hub.